True Ultimate Standards Everywhere, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF TRUE ULTIMATE STANDARDS EVERYWHERE, INC., D/B/A TRUSTE, INC.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATION OF SEC. 5(A) OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4512; File No. 132 3219 Complaint, March 12, 2015 – Decision, March 12, 2015 This consent order settles allegations that TRUSTe, Inc (“TRUSTe”) deceived consumers about its privacy seal program, its privacy practices, and its status as a non-profit entity. The complaint alleges that from 2006 until January 2013, TRUSTe failed to conduct annual recertifications of companies holding TRUSTe privacy seals in over 1,000 incidences, despite providing information on its website that companies holding TRUSTe Certified Privacy Seals receive recertification every year. In addition, the complaint alleges that, although TRUSTe became a for-profit corporation in 2008, the company failed to require its clients using TRUSTe seals to update references to TRUSTe’s forprofit status. Under the terms of the order, TRUSTe is prohibited from making misrepresentations about its certification process, its corporate status, or whether an entity participates in its programs. TRUSTe is also barred from providing other companies or entities with the means to make misrepresentations about these facts. The order also requires the company in its role as a COPPA safe harbor to provide detailed information about its COPPArelated activities in its annual filing to the FTC, as well as maintaining comprehensive records about its COPPA safe harbor activities for ten years. Each of these provisions represents an added requirement over the reporting requirements laid out under the COPPA rule for safe harbor programs. The company is further required to pay $200,000 in disgorgement. Participants For the Commission: Jamie Hine and Jessica Lyon. For the Respondent: Adam J. Fleisher and D. Reed Freeman, Morrison & Foerster LLP.

COMPLAINT The Federal Trade Commission (“Commission”), having reason to believe that True Ultimate Standards Everywhere, Inc., a corporation, has violated the provisions of the Federal Trade Commission Act (“FTC Act”), and it appearing to the Commission that this proceeding is in the public interest, alleges: TRUSTe, INC. 971 Complaint 1. Respondent True Ultimate Standards Everywhere, Inc., also doing business as TRUSTe, Inc. (“TRUSTe”), is a privatelyowned, Delaware corporation with its principal office or place of business at 835 Market Street, Suite 800, San Francisco, California 94103.

2. TRUSTe was formed as a California non-profit corporation on June 10, 1997. On June 20, 2008, TRUSTe formed a for-profit Delaware corporation and transferred all of the assets of the California non-profit entity to the for-profit corporation pursuant to an Asset Purchase Agreement effective July 3, 2008.

3. Respondent has advertised, offered for sale, and sold data privacy services to companies, including a variety of assessments and certifications, monitoring tools, and compliance controls. 4. The acts and practices of Respondent as alleged in this complaint are in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. § 44. TRUSTE’S CERTIFIED PRIVACY SEALS 5. Since approximately June 1997, Respondent has offered clients Certified Privacy Seals (“Privacy Seals”) for display on clients’ websites. TRUSTe has more recently offered these seals for mobile applications. Respondent provides these seals to clients that meet designated requirements for the programs that Respondent administers (“Program Requirements”). These requirements include specifications related to transparency of company practices, verification of privacy practices, and consumer choice regarding the collection and use of consumer personal information.

6. Respondent advertises itself as “the #1 privacy brand” and asserts that its “Certified Privacy Seal is recognized globally by consumers, businesses, and regulators as demonstrating privacy best practices.”

7. Respondent’s Privacy Seal programs include, but are not limited to, TRUSTed Websites (since 1997), which certifies TRUSTe, INC. 972 Complaint websites; COPPA/Children’s Privacy (2001), which certifies compliance with the FTC’s Children’s Online Privacy Protection Act Rule; EU Safe Harbor (2002), which assists with certification to the EU-US Safe Harbor framework for transatlantic data transfers; TRUSTed Downloads (2006), which certifies software; TRUSTed Cloud (2011), which certifies data processing services through cloud platforms; TRUSTed Apps (2011), which certifies mobile applications; and TRUSTed Data (2011), which certifies data collection practices of non-consumer facing entities. 8. Companies that meet the Program Requirements of a particular Privacy Seal must display to consumers a corresponding seal on their websites and mobile applications to demonstrate publicly to consumers their compliance with the relevant TRUSTe program.

9. In connection with its Privacy Seal programs, Respondent has provided clients with images of seals to display on their websites and mobile applications, including, but not limited to “Click-to-verify” seals containing a graphic icon, and text indicating to consumers an ability to click on the seal: These “Click-to-verify” seals are required and must be displayed by a client on its privacy policy webpage. They are linked to a webpage hosted on the www.truste.com website, which provides verification of the sealholder’s name, the specific privacy seal(s) held, and the validity date for each seal. The website also links to the Program Requirements for the Privacy Seals.

10. Respondent tests and verifies client compliance with its Program Requirements underlying its Privacy Seals through scanning technology, client interviews, document collection, and manual testing and review of client websites and mobile applications.

11. TRUSTe purports to recertify privacy sealholders on an annual basis to identify, for example: (1) material changes to privacy policies (e.g., new or expanded collection/uses of personal information such as use of cookies for behavioral advertising); (2) seal validation (e.g., improper placement, old versions, and bad TRUSTe, INC. 973 Complaint links); (3) changes in company ownership or business model (e.g., adoption of advertising supported content); and (4) where relevant, compliance with external third-party program requirements (e.g., Federal Trade Commission Children’s Online Privacy Protection Act safe harbor, or U.S. Department of Commerce self-certification to the US/EU Safe Harbor). 12. At all times relevant to this complaint, Respondent has controlled the design of its seals, as well as the design, content, and format of the www.truste.com webpage to which these seals link.

VIOLATIONS OF SECTION 5 OF THE FTC ACT MISREPRESENTATION OF CERTIFICATION STATUS OF TRUSTE CLIENTS 13. Since approximately 2011, Respondent has disseminated or has caused to be disseminated to consumers, on the www.truste.com website, Program Requirements containing the following statement:

III. Minimum Program Requirements … B. Participant Accountability … 3. Annual Recertification a. Participant shall undergo recertification to verify ongoing compliance with these Program Requirements annually.

(Exhibit A, Program Requirements, February 2011, available at www.truste.com) Prior to 2011, Respondent disseminated or had caused to be disseminated to consumers Program Requirements containing the following statement: II. Participant Responsibilities . . .

C. Recertification. Participant must seek recertification by TRUSTe annually . . .

TRUSTe, INC. 974 Complaint 14. The statements set forth in Paragraph 13 have been included in Respondent’s Program Requirements for at least each of the following programs: TRUSTed Websites (since 1997), COPPA/Children’s Privacy (2001), EU Safe Harbor (2002), TRUSTed Cloud (2011), TRUSTed Apps (2011), TRUSTed Data (2011), and TRUSTed Smart Grid (2012).

COUNT 1 15. Through the means described in Paragraph 13, Respondent has represented, expressly or by implication, that TRUSTe has recertified annually all companies displaying a TRUSTe Certified Privacy Seal to ensure ongoing compliance with the Program Requirements.

16. In fact, from 2006 until January 2013, Respondent did not conduct annual recertifications for all companies holding TRUSTe Certified Privacy Seals. In over 1,000 instances, TRUSTe conducted no annual review of the company’s compliance with applicable Program Requirements. Therefore, the representation set forth in Paragraph 13 was false or misleading.

MISREPRESENTATIONS REGARDING NON-PROFIT STATUS OF TRUSTE 17. Prior to its transition to a for-profit entity on July 3, 2008, Respondent required its clients to display in their privacy policies the following language TRUSTe developed: “TRUSTe is an independent, non-profit organization whose mission is to build users’ trust and confidence in the Internet by promoting the use of fair information practices.”

18. In early July 2008, Respondent notified all active and current clients that its tax status would change from non-profit to for-profit status. On July 15, 2008, the company issued a public press release announcing the company’s transition to a for-profit entity.

TRUSTe, INC. 975 Complaint 19. In numerous instances since July 3, 2008, the date when TRUSTe formed a for-profit Delaware corporation and ceased to be a non-profit California corporation, Respondent has recertified clients who have failed to update references to the company’s forprofit status. Some TRUSTe clients’ privacy policies continued to describe TRUSTe as a non-profit entity until fall of 2013. Count 2 20. Through the means described in Paragraphs 17 and 19, Respondent has represented, expressly or by implication, that TRUSTe is a non-profit organization.

21. In fact, Respondent has not been a non-profit organization since July 3, 2008. Therefore, the representation set forth in Paragraph 20 was false or misleading.

22. By providing clients with the language in Paragraph 17 and continuing to certify clients using that language as described in Paragraph 19, Respondent has furnished the means and instrumentalities for the commission of the deceptive acts or practices alleged in Paragraph 21.

23. The acts and practices of Respondent as alleged in this complaint constitute deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a).

THEREFORE, the Federal Trade Commission this twelfth day of March, 2015, has issued this complaint against Respondent.

By the Commission.

TRUSTe, INC. 988 Decision and Order DECISION AND ORDER The Federal Trade Commission (“Commission” or “FTC”), having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft of complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge Respondent with violations of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45 et seq.;

The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), which includes: a statement by Respondent that it neither admits nor denies any of the allegations in the draft complaint, except as specifically stated in the Consent Agreement, and, only for purposes of this action, admits the facts necessary to establish jurisdiction; and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the Respondent has violated the FTC Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, and having duly considered the comments filed by interested persons, now in further conformity with the procedure prescribed in Commission Rule 2.34, 16 C.F.R. § 2.34, the Commission hereby issues its Complaint, makes the following jurisdictional findings, and enters the following Order:

1. Respondent True Ultimate Standards Everywhere, Inc., also doing business as TRUSTe, Inc., is a privately-owned, Delaware corporation with its principal office or place of business at 835 Market Street, Suite 800, San Francisco, California 94103. 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the TRUSTe, INC. 989 Decision and Order Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

1. “Seal” shall mean any trustmark, logo, seal of approval, emblem, shield, or other insignia Respondent has offered or provided for placement on a company’s website, including, but not limited to TRUSTed Websites, COPPA/Children’s Privacy, EU Safe Harbor, TRUSTed Cloud, TRUSTed Apps, and TRUSTed Data.

2. Unless otherwise specified, “Respondent” shall mean True Ultimate Standards Everywhere, Inc., and its successors and assigns.

3. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. 4. “COPPA” shall mean the Federal Trade Commission’s Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312.

5. “COPPA safe harbor program” shall mean any selfregulatory program [guidelines] established pursuant to 16 C.F.R. § 312.11 of the Federal Trade Commission’s Children’s Online Privacy Protection Rule and operated by Respondent.

I.

IT IS ORDERED that Respondent, directly or through any corporation, subsidiary, division, or other device, including franchisees, or licensees, in connection with the advertising, promotion, offering for sale, sale, or distribution of seals or certifications, or any other substantially similar product, in or TRUSTe, INC. 990 Decision and Order affecting commerce, shall not misrepresent, in any manner, expressly or by implication:

A. The steps it takes to evaluate, certify, review, or recertify a company’s privacy practices; B. The frequency with which Respondent conducts any such evaluation, certification, review, or recertification of a company’s privacy practices; C. The corporate status of Respondent and its independence; and D. The extent to which the person or entity is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy program sponsored by Respondent.

II.

IT IS FURTHER ORDERED that Respondent, directly or through any corporation, subsidiary, division, or other device, including franchisees, or licensees, shall not provide to any person or entity the means and instrumentalities with which to make directly or by implication any misrepresentation prohibited by Part I of this order. For purposes of this Part, “means and instrumentalities” shall mean any information, including but not necessarily limited to, any required or model language, for use in any privacy policy or statement for display on a website or mobile application covered by any seal or certification provided by Respondent, or any other product or service covered under this order, in or affecting commerce.

III.

IT IS FURTHER ORDERED that Respondent for ten (10) years after the date of service of this order, as part of its annual report required to be submitted pursuant to 16 C.F.R. §312.11(d)(1) of the COPPA Rule, shall, in a sworn statement provide:

TRUSTe, INC. 991 Decision and Order A. The total number of new seals awarded to participants in any COPPA safe harbor program in the preceding reporting period;

B. A detailed explanation of the mechanisms used by Respondent to assess the fitness of new applicants to any COPPA safe harbor program for membership in the program;

C. A detailed explanation of the mechanisms used by Respondent to assess the continuing fitness of an existing participant in any COPPA safe harbor program for membership in the program; and D. Any additional steps Respondent undertook to comply with the requirements of 16 C.F.R. § 312. Unless otherwise directed by a representative of the Commission, all statements required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580, with the subject line In the Matter of TRUSTe, Inc., FTC File No. 1323219. Provided, however, that in lieu of overnight courier, notices may be sent by first-class mail, but only if an electronic version of any such notice is contemporaneously sent to the Commission at [email protected].

IV.

IT IS FURTHER ORDERED that Respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of ten (10) years from the date of preparation: A. A detailed explanation of assessments Respondent conducted during the preceding reporting period to determine the fitness of new applicants to any COPPA safe harbor program for membership in the program; B. A detailed explanation, including the frequency, of assessments Respondent conducted during the TRUSTe, INC. 992 Decision and Order preceding reporting period to determine the continuing fitness of an existing participant in any COPPA safe harbor program for membership in the program; C. Any documents related to consumer complaints, received in the preceding reporting period, alleging violations of any COPPA safe harbor program by Respondent or by participants in any COPPA safe harbor program;

D. Any documents related to records of disciplinary actions taken in the preceding reporting period against participants in any COPPA safe harbor program; and E. Any documents related to approvals of COPPA safe harbor program participants’ use of verifiable parental consent mechanism under 16 C.F.R. § 312.11(d)(1). V.

IT IS FURTHER ORDERED that within five (5) days of the date of service of this order, Respondent shall pay $200,000 to the United States Treasury as disgorgement, as follows: A. The payment shall be made by wire transfer to the Treasurer of the United States, in accordance with instructions provided by the Federal Trade Commission.

B. In the event of any default in payment, interest shall accrue, computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment. C. Respondent relinquishes all dominion, control, and title to the funds paid to the fullest extent permitted by law. Respondent shall make no claim to or demand return of the funds, directly or indirectly, through counsel or otherwise.

TRUSTe, INC. 993 Decision and Order VI.

IT IS FURTHER ORDERED that Respondent shall maintain and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of, for a period of five (5) years from the date of preparation or dissemination, whichever is later, all documents, whether in written or electronic form, that relate to compliance with this order, including but not limited to:

A. all advertisements and promotional materials containing any representations covered by this order, with all materials used or relied upon in making or disseminating the representation;

B. consumer complaints (whether received directly, indirectly, or through any third party) that relate to Respondent’s activities as alleged in the draft Complaint and Respondent’s compliance with the provisions of this order; and any responses to such complaints;

C. copies of all subpoenas and other communications with law enforcement entities or personnel, if such documents bear in any respect on Respondent’s activities as alleged in the Complaint and Respondent’s compliance with the provisions of this order; and D. any documents, whether prepared by or on behalf of Respondent, that call into question Respondent’s compliance with this order.

VII.

IT IS FURTHER ORDERED that Respondent shall deliver a copy of this order to all current and future subsidiaries, current and future principals, officers, directors, and managers having responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current subsidiaries and personnel within thirty (30) days after service of this order, and to such future subsidiaries and personnel within thirty (30) TRUSTe, INC. 994 Decision and Order days after the person assumes such position or responsibilities. For any business entity resulting from any change in structure set forth in Part VIII, delivery shall be at least ten (10) days prior to the change in structure. Respondent must secure a signed and dated statement acknowledging receipt of this order, within thirty (30) days of delivery, from all persons receiving a copy of the order pursuant to this Part.

VIII.

IT IS FURTHER ORDERED that Respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation(s) about which Respondent learns fewer than thirty (30) days prior to the date such action is to take place, Respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. Unless otherwise directed by a representative of the Commission, all notices required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580, with the subject line In the matter of True Ultimate Standards Everywhere, Inc., FTC File No. 1323219. Provided, however, that in lieu of overnight courier, notices may be sent by first-class mail, but only if an electronic version of any such notice is contemporaneously sent to the Commission at [email protected].

IX.

IT IS FURTHER ORDERED that Respondent, within one hundred twenty (120) days after the date of service of this order, shall file with the Commission a true and accurate report, in writing, setting forth in detail the manner and form of its compliance with this order. Within ten (10) days of receipt of TRUSTe, INC. 995 Decision and Order written notice from a representative of the Commission, it shall submit an additional true and accurate written report. X.

This order will terminate on March 12, 2035, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this order that terminates in fewer than twenty (20) years;

B. This order’s application to any Respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that Respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order as to such Respondent will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

TRUSTe, INC. 996 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, an agreement containing an order from True Ultimate Standards Everywhere, Inc. (“TRUSTe”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission again will review the agreement and the comments received and will decide whether it should withdraw from the agreement or make final the agreement’s proposed order.

This matter involves respondent’s marketing and distribution of a variety of online privacy seals (“seals”) for companies to display on their websites. The FTC complaint alleges that respondent violated Section 5(a) of the FTC Act by falsely representing to consumers the frequency with which it reviews and verifies the practices of companies displaying its website and mobile seals. Specifically, the complaint alleges that from June 1997 until January 2013, respondent failed to conduct annual recertifications for almost 1,000 companies holding respondent’s TRUSTed Websites, COPPA/Children’s Privacy, EU Safe Harbor, TRUSTed Cloud, TRUSTed Apps, TRUSTed Data, and TRUSTed Smart Grid seals. In addition, the complaint alleges that respondent provided to its sealholders the means and instrumentalities to misrepresent that respondent is a non-profit corporation. The FTC complaint describes, with specificity, that following respondent’s transition to a for-profit corporation in July 2008, respondent recertified numerous clients whose privacy policies continued to describe TRUSTe as a non-profit entity. The proposed consent order contains provisions designed to prevent respondent from engaging in similar acts and practices in the future. Part I of the proposed order prohibits respondent from misrepresenting (1) the steps respondent takes to evaluate, certify, review, or recertify a company’s privacy practices; (2) the frequency with which respondent evaluates, certifies, reviews, or recertifies a company’s privacy practices; (3) the corporate status of respondent and its independence; and (4) the extent to which TRUSTe, INC. 997 Analysis to Aid Public Comment any person or entity is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy program sponsored by respondent. Part II of the proposed order prohibits respondent from providing to any person or entity the means and instrumentalities (including any required or model language for use in any privacy policy or statement) to misrepresent any of the same items in Part I of the proposed order. Parts III and IV of the proposed order contain additional reporting requirements with respect to respondent’s COPPA/Children’s Privacy seal. First, the proposed order expands respondent’s COPPA recordkeeping and reporting requirements to ten years. Second, the proposed order requires respondent to report (1) the number of new seals it awards; (2) how it assesses the fitness of members; and (3) any additional steps it takes to monitor compliance with the safe harbor requirements. Third, the proposed order expands respondent’s COPPA requirement to retain consumer complaints and descriptions of disciplinary actions to include consumer complaints related to respondent and its safe harbor program participants as well as all documents related to disciplinary actions taken by respondent. Fourth, the proposed order imposes additional COPPA recordkeeping requirements, such as a requirement that respondent retain detailed explanations of assessments of new and existing applicants in any COPPA safe harbor program.

Part V of the proposed order requires respondent to pay $200,000 to the United States Treasury as disgorgement. The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed complaint order or to modify in any way the proposed order’s terms.

TRUSTe, INC. 998 Concurring Statement STATEMENT OF CHAIRWOMAN RAMIREZ, COMMISSIONER BRILL, AND COMMISSIONER MCSWEENEY We write to express our strong support for the complaint and consent order in this case.

The Commission unanimously supports Count I of the complaint in this matter, which is of paramount importance, in light of TRUSTe’s unique role in increasing consumer trust in the global marketplace and ensuring the effectiveness of relevant selfregulatory frameworks. TRUSTe operates privacy-related selfregulatory and oversight programs for businesses and offers certified privacy seals for program participants, including (1) COPPA/Children’s Privacy, which certifies compliance with the Children’s Online Privacy Protection Act and implementing regulations; (2) EU Safe Harbor, which certifies compliance with the U.S.-EU Safe Harbor Framework; (3) TRUSTed Apps, which certifies the privacy practices of mobile applications; and (4) APEC Privacy, which certifies compliance with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System.1 In Count I, the Commission alleges that TRUSTe promised consumers it would annually recertify its self-regulatory program participants for compliance with TRUSTe’s privacy program requirements, but that, in many instances, it failed to do so. Annual recertification is a cornerstone of the service TRUSTe provides. It helps ensure that companies (1) continue to follow TRUSTe’s program requirements, (2) do not make material changes to their practices or policies without appropriate consent, and (3) periodically consider the impact of technology and marketplace developments in their privacy practices. TRUSTe did not fulfill its obligations; today’s order helps to ensure that TRUSTe will do so in the future. Consumers who see the TRUSTe seal on a website or mobile app should be confident that a trusted third party has kept its promise to review and vouch for the privacy practices of that website or mobile app. We also TRUSTe’s APEC Privacy certification program was not the subject of the allegations in the complaint. TRUSTe became an “Accountability Agent” for the APEC Cross-Border Privacy Rules System in June 2013, and issued its first certification under that program in August 2013. TRUSTe, INC. 999 Concurring Statement believe that Count II represents an appropriate use of “means and instrumentalities” liability. At the time TRUSTe provided model language for its clients’ privacy policies stating that TRUSTe was a nonprofit entity, there is no question that the statement was true. However, after TRUSTe informed clients of its for-profit status in 2008, many clients neglected to update their policies and continued to represent that TRUSTe was a nonprofit entity. These ongoing representations by TRUSTe’s clients clearly became deceptive once TRUSTe converted to a for-profit entity. Yet for five years, TRUSTe continued to recertify some companies that included this deceptive statement, that TRUSTe itself had disseminated, in their privacy policies. TRUSTe was wellpositioned to rectify the misrepresentation about its own corporate status – it could have elected simply not to recertify the companies in question until the misrepresentation was cured. It failed to take this straightforward step and instead continued to bless the language at issue by giving the companies its seal of approval.

In Shell Oil Company and FTC v. Magui Publishers, Inc., which Commissioner Ohlhausen cites in her statement, the Commission concluded that by providing customers with engage in deceptive acts or practices.1 In this case, although TRUSTe disclosed to clients its change in status, it continued to recertify privacy policies using language TRUSTe had itself supplied about its corporate status that was no longer true. TRUSTe’s recertification of these inaccurate privacy policies is the conduct we take aim at – it provided a stamp of approval of a false representation which TRUSTe’s clients then passed along to consumers via their websites. As such, TRUSTe provided its clients with the means and instrumentalities to deceive others. The application of means and instrumentalities liability in this case is consistent with the principle underlying Shell and Magui Publishers, namely, that one who places the means of deception in the hands of another is also liable for the deception under Section 5.2 The inclusion of this count is particularly appropriate In the Matter of Shell Oil Co., 128 F.T.C. 749 (1999); FTC v. Magui Publishers, Inc., No. 89-3818RSWL(GX), 1991 WL 90895 (C.D. Cal. Mar. 28, 1991), aff’d 9 F.3d 1551 (9th Cir. 1993). Commissioner Ohlhausen suggests that the allegations underlying Count II would be more appropriately viewed through the lens of secondary “aiding TRUSTe, INC. 1000 Dissenting Statement here, given TRUSTe’s unique position in the privacy selfregulatory ecosystem. Companies that purport to hold their clients accountable to protect consumer privacy should themselves be held to an equally high standard.

PARTIAL DISSENT OF COMMISSIONER MAUREEN K. OHLHAUSEN I support Count I of the complaint in this matter because of TRUSTe’s unique position of consumer trust as a third party certifier. However, I do not support the use of “means and instrumentalities” liability in Count II of the complaint and dissent as to that Count.

TRUSTe was initially organized in 1997 as a non-profit. Before July 2008, TRUSTe required every certified client website to include in its privacy policy a description of TRUSTe stating in part, “TRUSTe is [a] non-profit organization.” On July 3, 2008, TRUSTe changed its corporate form from non-profit to for-profit. The company announced the change to its clients and requested that all clients update the relevant privacy policy language on their websites. Some clients did not update their websites. When TRUSTe recertified such websites, TRUSTe would typically request, but not require, that the client update their privacy policy to reflect the change to for-profit status. Count II of our complaint alleges that by recertifying websites containing privacy policies that inaccurately describe TRUSTe as a non-profit, TRUSTe provided the means and instrumentalities to its clients to misrepresent that TRUSTe was a non-profit corporation. Specifically, the majority’s statement argues that “TRUSTe’s recertification of these inaccurate privacy policies … and abetting” liability. Regardless of whether one could construct alternative theories of liability, our concern is with TRUSTe’s own actions. As discussed above, the deception here was the result of TRUSTe’s own actions. TRUSTe, INC. 1001 Dissenting Statement provided its clients with the means and instrumentalities to deceive others.”3 I disagree with this use of means and instrumentalities. To be liable of deception under means and instrumentalities requires that the party itself must make a misrepresentation, as the Commission detailed in Shell Oil Company.4 According to the majority in that case, “[T]he means and instrumentalities doctrine is intended to apply in cases … where the originator of the unlawful material is not in privity with consumers” and “it is well settled law that the originator is liable if it passes on a false or misleading representation with knowledge or reason to expect that consumers may possibly be deceived as a result.”5 For example, in FTC v. Magui Publishers, Inc., the court found the defendant directly liable for providing the means and instrumentalities to violate Section 5 when it sold Salvador Dali prints with forged signatures to retail customers, who then sold the prints to consumers.6 Unlike Shell and Magui Publishers, the statement that TRUSTe provided to its clients was indisputably truthful at the time. During the period in which TRUSTe required client privacy policies to state that TRUSTe was a non-profit, TRUSTe was, in In the Matter of True Ultimate Standards Everywhere, Inc. (“TRUSTe”), FTC File No. 1323219, Statement of Chairwoman Ramirez, Commissioner Brill, and Commissioner McSweeny, at 2 (Nov. 17, 2014). 4 In the Matter of Shell Oil Co., 128 F.T.C. 749 (1999). Id. at *10 (Public Statement of Chairman Pitofsky, Commissioner Anthony and Commissioner Thompson) (emphasis added). Similarly, Commissioner Orson Swindle’s dissent stated that under FTC precedent, “means and instrumentalities is a form of primary liability in which the respondent was using another party as the conduit for disseminating the respondent’s misrepresentations to consumers.” Id. at *14-15 (Dissenting Statement of Commissioner Orson Swindle) (emphasis added). Swindle’s dissent likewise emphasized that a defendant “may not be held primarily liable unless it has actually made a misrepresentation.” Id. (quoting In re JWP Inc. Securities Lit., 928 F. Supp. 1239, 1256 (S.D.N.Y. 1996)). See also FTC v. Magui Publishers, Inc., Civ. No. 89–3818RSWL(GX), 1991 WL 90895, at *14, (C.D. Cal. 1991), aff'd, 9 F.3d 1551 (9th Cir. 1993) (“One who places in the hands of another a means or instrumentality to be used by another to deceive the public in violation of the FTC Act is directly liable for violating the Act.”).

6 Magui Publishers, Inc., 1991 WL 90895, at *17. TRUSTe, INC. 1002 Dissenting Statement fact, a non-profit. Once TRUSTe changed to for-profit status, it no longer required clients to state its non-profit status and actively encouraged clients to correct their privacy policies. TRUSTe did not pass to clients any false or misleading representations regarding its for-profit status. Nor was TRUSTe’s recertification of websites a misrepresentation of TRUSTe’s non-profit status to its clients; during recertification TRUSTe again clearly communicated its for-profit status to clients by requesting that its clients update their privacy policies. Because TRUSTe accurately represented its non-profit status to its clients, TRUSTe cannot be primarily liable for deceiving consumers under a means and instrumentalities theory.

TRUSTe’s alleged recertifications of untrue statements are more properly analyzed as secondary liability for aiding and abetting.7 In Magui Publishers the court found that the defendant forgers were not only directly liable for their own misstatements, but also secondarily liable for the retailers’ fraudulent misrepresentations to consumers because defendants “supplied their deceptive art work, certificates and promotional materials to their retail customers with full knowledge these customers would use the materials to deceive consumers.”8 The court explained that aiding and abetting has three components: “(1) the existence of an independent primary wrong; (2) actual knowledge by the alleged aider and abettor of the wrong and of his or her role in furthering it; and (3) substantial assistance in the commission of the wrong.”9 It is not clear that TRUSTe’s clients committed an independent primary wrong. However, TRUSTe certainly had “[A] respondent who has provided assistance to another party that has made misrepresentations is at most secondarily liable -- in particular, for aiding and abetting another's misrepresentations.” Shell Oil Co., 128 F.T.C. 749, *15 (1999) (Swindle Dissent) (citing Wright v. Ernst & Young LLP, 152 F.3d 169, 175 (2d Cir. 1998), cert. denied, 119 S.Ct. 870 (1999); Shapiro v. Cantor, 123 F.3d 717, 720 (2d Cir. 1997); Anixter v. Home-Stake Production Co., 77 F.3d 1215, 1225 (10th Cir. 1996) (“the critical element separating primary from aiding and abetting violations is the existence of a representation, made by the defendant.”)).

8 Magui Publishers, Inc., 1991 WL 90895, at *15. 9 Id. at *14.

TRUSTe, INC. 1003 Dissenting Statement knowledge of the misstatements in the privacy policies and of TRUSTe’s role in facilitating those misstatements. And, arguably, its certifications may have provided substantial assistance in deceiving consumers. Regardless, because TRUSTe never misrepresented its corporate status, TRUSTe’s actions regarding its corporate status at most comprise aiding and abetting its clients’ actions.

Perhaps all this seems like legal hairsplitting, but it is not. Under the Supreme Court’s decision in Central Bank of Denver v. First Interstate Bank of Denver,10 the FTC “may well be precluded from bringing Section 5 cases under an aiding and abetting theory.”11 By prosecuting activities more properly analyzed as aiding and abetting under the guise of means and instrumentalities liability, I am concerned that we are stepping beyond the limits the Supreme Court has established. I therefore dissent from Count II.

10 Cent. Bank, N.A. v. First Interstate Bank, N.A., 511 U.S. 164 (1994). 11 Shell Oil Co., 128 F.T.C. 749, *19 (Swindle Dissent). MPHJ TECHNOLOGY INVESTMENTS, LLC 1004 Complaint