Category: Consumer Protection

The Rise of Annuities – A Riddle Wrapped in a Mystery Inside an Enigma? [Podcast]

“A riddle wrapped in a mystery inside an enigma.” That’s Winston Churchill describing Russia in 1939. The words puzzle and paradox have long been associated with annuities, marking them as one of the most difficult financial products to demystify. Recently, there has been a significant increase in annuity sales, which has added to the enigma. Why are they suddenly becoming so popular? Estate planning attorneys should know at least some basics.

The Original Annuity Riddle

The original annuity puzzle (the annuity market participation puzzle) refers to the economic paradox where retirees rarely choose to annuitize their wealth despite theoretical models suggesting this would be optimal for lifetime consumption smoothing and longevity risk protection. Classical economic theory, particularly as developed by Yaari (1965) (1), suggests that risk-averse individuals without strong bequest motives should convert a substantial portion of their wealth into lifetime annuities to hedge against outliving their assets; this optimizes their economic utility. They benefit from the insurance aspect of an annuity. Payouts are generally guaranteed for a lifetime, but the contract is priced according to average life expectancies.

However, in practice, voluntary annuity participation rates remain remarkably low across most developed countries. This discrepancy between theoretical predictions and observed behavior has sparked extensive research into potential explanations, including behavioral biases, bequest motives, concerns about healthcare costs, mistrust of insurance companies, desire for liquidity, existing annuities through Social Security and pensions, and the role of family risk-sharing.

The disinterest in annuities seems to be changing. Figure 1 shows a very recent trend of significantly increased annuity sales.

Growth in Annuity Sales Volume since 2004. Data from LIMRA

Figure 1: Growth in Annuity Sales Volume since 2004. Data from LIMRA. © wealthcarelawyer.com

The New Annuity Mystery – Why are Annuities Suddenly so Attractive?

There is no definitive answer. However, it is interesting that growth is driven almost exclusively by fixed annuities. A fixed annuity provides a guaranteed interest rate and principal protection since the insurance company bears the investment risk, but it typically offers lower potential returns with simpler features and lower fees. This maximizes the insurance aspect of an annuity.

In contrast, the returns of a variable annuity are tied to the performance of an investment portfolio chosen by the owner who bears the investment risk. These annuities offer higher potential returns and associated downside risk but with more complex features, higher management fees, and optional features like guaranteed income riders.

The most recent record federal deficit increase (red) seems to precede the increase in annuity sales. In contrast, good stock market performance should reduce the interest in annuities.

Figure 2: The most recent record federal deficit increase (red) seems to precede the increase in annuity sales. In contrast, good stock market performance should reduce the interest in annuities.

© wealthcarelawyer.com

Annuities are priced by calculating the present value of future payment obligations, adjusted for mortality risk, expenses, and profit margins. Insurance companies start with the principal investment and determine what payment stream they can provide based on current interest rates, actuarial tables (which predict how long they will need to make payments), their operating costs, and their desired profit margin. Higher interest rates generally allow for larger payments. In contrast, longer life expectancies, additional guarantee features, and higher expenses reduce the payment amounts the insurer can offer for a given principal investment.

In the first quarter of 2024, annuity sales reached a record $113.5 billion, marking the highest first-quarter sales figure in the 40-year history of Limra’s data tracking. While it is unclear what caused the sudden increase in the popularity of annuities, we believe that concern for the viability of Social Security because of the ballooning deficit may have contributed to it. LIMRA offers an alternative evaluation:

“Favorable economic conditions and demographic shifts have driven demand for investment protection and guaranteed lifetime income solutions that are unique to annuity products. During their discussion, Hodgens focused on the economic factors, such as higher interest rates and prolonged market volatility, which have enhanced the value and appeal of fixed annuity products, particularly fixed-rate deferred (FRD) and fixed indexed annuities (FIA).” (2).

It is also possible that current affluent baby boomers, as the sandwich generation, see value in diversifying with annuities: The annuity is considered spending money to help assure a certain standard of living, while investments are invaded only sparingly to allow for a growing legacy for the next generation. A guaranteed income stream from an annuity can provide psychological permission for retirees to spend more freely on themselves. Without an annuity, many retirees tend to be overly conservative with spending, worried about depleting their savings too quickly or not having enough for longevity and emergencies.

The Annuity Product Enigma

In an effort to make annuities more attractive, the industry has developed numerous products that address various concerns and preferences clients may have. As a general rule, many of the special flavors partially defeat the economic purpose of an annuity, which is utility maximization for persons without a strong bequest motive.

Some of the major annuity families and species

Figure 3: Some of the major annuity families and species. © wealthcarelawyer.com

Annuity contracts have evolved from basic guaranteed income instruments into complex financial products, each structured to address specific risk-transfer and income objectives. This evolution has produced three distinct primary classifications: Fixed, Variable, and Indexed annuities.

Fixed Annuities represent the foundational form. The Single Premium Immediate Annuity (SPIA) facilitates direct risk transfer through immediate income guarantees, leveraging mortality credits to enhance returns. Deferred Income Annuities (DIAs) modify this framework by introducing a time delay element, optimizing for future income maximization. Qualified Longevity Annuity Contracts (QLACs) emerged as a specialized adaptation to retirement account regulations, permitting Required Minimum Distribution deferral to age 85, subject to statutory limitations ($200,000). Multi-Year Guaranteed Annuities (MYGAs) provide fixed-rate guarantees over specified periods, offering liquidity features absent in traditional fixed annuities.

Variable Annuities evolved to incorporate market exposure through separate account structures. The basic Investment-Only variant provides tax-deferred market participation, while Living Benefit riders introduced protective features:

  • Guaranteed Lifetime Withdrawal Benefits (GLWB) ensure sustained withdrawal rates
  • Guaranteed Minimum Income Benefits (GMIB) protect future income bases
  • Guaranteed Minimum Accumulation Benefits (GMAB) provide principal protection parameters

Indexed Annuities represent a hybrid development, linking returns to market indices while maintaining principal protection. Structured/Buffered variants modify this framework by accepting defined downside exposure in exchange for enhanced participation rates.

Tax treatment bifurcates between:

  • Qualified: Pre-tax funding, full distribution taxation
  • Non-Qualified: After-tax funding, exclusion ratio calculations

Contract modifications across all variants may include:

  • Mortality benefit enhancements
  • Inflation adjustment mechanisms
  • Long-term care provisions
  • Premium return options
  • Distribution structure alternatives

This taxonomic framework provides the foundation for analyzing suitability, tax implications, and regulatory considerations across various client objectives and constraints.

Client Self Help

More information about annuities is not necessarily more helpful to consumers: “More complete, and therefore more complex information about annuity products leads to reduced attention and produces worse consumer choices. In an eye-tracking experiment comparing consumer response to a real, relatively brief annuity brochure and an edited and shortened version of the same brochure, we find that the more complex the materials, the faster attention declines.” (3).

This underscores the need for a learned intermediary to digest the information and to tailor it to the individual’s needs, preferences, and financial situation, who can ask clarifying questions to ascertain understanding.

Given a certain contract amount and their ages, many clients want to know what monthly or annual income they can expect given the current rate structures. The Annuity Calculator by annuity.org promises to do that. Others, such as Schwab, have similar annuity calculators, and results may differ.

How to Help Your Estate Planning Clients

The increasing complexity and popularity of annuity products present both opportunities and challenges for estate planning attorneys. Given the recent surge in annuity sales and evolving product complexity, attorneys must establish clear parameters for client discussions regarding these financial instruments.

Estate planning attorneys can appropriately address annuities by maintaining strict professional boundaries while providing valuable guidance. The fundamental framework involves three key components: permissible discussion parameters, professional referral protocols, and risk management considerations.

Permissible Discussion Parameters: Estate planning attorneys may appropriately discuss the theoretical foundations of annuities, including their role in consumption smoothing and longevity risk protection as established in classical economic theory. Discussions may encompass general tax implications, basic product classifications (fixed, variable, and indexed), and integration with estate planning objectives.

Professional Referral Protocols: Given the product complexity illustrated in the annuity taxonomy, specific product recommendations should be deferred to qualified specialists. Appropriate referral channels include:

  • Independent Annuity Brokers
  • Independent Insurance Advisors
  • Certified Financial Planners (CFPs)
  • Chartered Life Underwriters (CLUs)

Risk Management Considerations Documentation protocols should include:

  • Contemporaneous recording of annuity-related discussions
  • Specific referral documentation
  • Clear delineation of scope limitations regarding product recommendations

The attorney’s role should focus on identifying how annuity contracts may integrate with broader estate planning objectives while ensuring clients receive specialized guidance for product selection. This approach aligns with the current market dynamics where product complexity demands specialized expertise beyond the scope of general estate planning practice.

Professional network development should emphasize relationships with independent advisors who maintain appropriate licensing and demonstrate expertise in the evolving annuity marketplace. This network enables appropriate delegation of product-specific guidance while maintaining the attorney’s role in the overall estate planning strategy.

This framework enables estate planning attorneys to address the increasing relevance of annuity products while maintaining appropriate professional boundaries and ensuring clients receive comprehensive guidance from qualified specialists regarding specific product selection and implementation.

Podcast

References

  1. Yaari, M.E., 1965. Uncertain lifetime, life insurance, and the theory of the consumer. The Review of Economic Studies, 32(2), pp.137-150.
  2. LIMRA, Building on the Record Annuity Sales Momentum, LIMRA (May 22, 2024), https://www.limra.com/en/newsroom/industry-trends/2024/building-on-the-record-annuity-sales-momentum/.
  3. Harvey, Joseph, John G. Lynch, Philip Fernbach, and Ji Hoon Jhang. “Information Overload in Consumer Response to Annuities: Eye-Tracking and Behavioral Evidence.” Consumer Financial Protection Bureau Office of Research Working Paper 23-01 (2023).

https://papers.ssrn.com/sol3/Delivery.cfm?abstractid=4394792

Further reading focused on Income Annuities

  1. LIMRA. (2024, May 22). First Quarter U.S. Annuity Sales Mark 14th Consecutive Quarter of Growth. Retrieved from https://www.limra.com/en/newsroom/news-releases/2024/limra-first-quarter-u.s.-annuity-sales-mark-14th-consecutive-quarter-of-growth/
  2. Fidelity Investments. (2023, June 5). Understanding Annuities. Retrieved from https://www.fidelity.com/learning-center/personal-finance/retirement/what-is-an-annuity
  3. Williams, R. (2023, April 12). The Case for Income Annuities When Rates Are Up. Retrieved from https://www.schwab.com/learn/story/case-income-annuities-when-rates-are-up
  4. Institute of Business and Finance. (2023, January). Certified Annuity Specialist Course Materials.
  5. Financial Industry Regulatory Authority. (2022, July 15). Deferred Income Annuities: Plan Now for Payout Later. Retrieved from https://www.finra.org/investors/insights/deferred-income-annuities
  6. Pfau, W. (2020, May 5). Income Annuities: The Guaranteed Stream Of Income In Retirement. Retrieved from https://www.forbes.com/sites/wadepfau/2020/05/05/income-annuities-the-guaranteed-stream-of-income-in-retirement/?sh=1f05b93e5143
  7. Kitces, M. (2015, April 1). Understanding The Role Of Mortality Credits – Why Immediate Annuities Beat Bond Ladders For Retirement Income. Retrieved from https://www.kitces.com/blog/understanding-the-role-of-mortality-credits-why-immediate-annuities-beat-bond-ladders-for-retirement-income/
  8. Cruz, H. (2005, July 24). Lifetime Income Benefit Rider vs. Annuitization. Retrieved from https://www.chicagotribune.com/news/ct-xpm-2005-07-24-0507240025-story.html
  9. Pfau, W. (n.d.). What Is a Safety-First Retirement Plan? Retrieved from https://retirementresearcher.com/what-is-a-safety-first-retirement-plan/
© 2024 wealthcarelawyer.com. All rights reserved.
For more on Annuities, visit the NLR Estates Trusts section

New York City Mayor Signs Hotel Safety and Licensing Law Imposing New Compliance Requirements on Hotel Operators

On November 4, 2024, New York City Mayor Eric Adams signed legislation to ensure hotel safety that will mandate a comprehensive licensing system for hotels to operate in New York City, implement several consumer safety protections, and require hotels to maintain continuous front-desk coverage, directly employ certain “core” employees, and provide human trafficking recognition training.

Quick Hits
New York City enacted a new hotel safety law that will require hotels to obtain a license to operate in the city and impose certain staffing requirements.
The law will require hotels to directly employ core employees, mainly housekeepers and front desk staff, avoiding the use of third-party staffing agencies.
The law is set to take effect 180 days after signing, or May 3, 2025.
The Safe Hotels Act, Int. No. 0991-2024, represents a significant shift in the regulatory landscape for New York City hotel operators, imposing several new employment and consumer compliance requirements as the city’s tourism industry rebounds from the pandemic.

“Our top priority from day one has been to keep people safe, and that includes protecting workers and tourists at our city’s hotels,” Mayor Adams said in a statement announcing the signing of the law. “That’s why we are expanding protections for the working-class New Yorkers who run our hotels and the guests who use them.”

Here is a breakdown of the key aspects of the new law.

Licensing
Under the new law, all hotel operators must obtain a license to operate within New York City. The license, valid for two years, requires a fee of $350. Hotel operators must submit detailed applications demonstrating their compliance with various staffing, safety, and operational standards. Violations of the new licensing requirements can result in significant civil penalties, ranging from $500 for a first offense to $5,000 for repeated offenses.

Staffing
The law will require hotel operators to provide continuous front desk coverage, either through front desk staff or, during overnight shifts, a security guard trained in human trafficking recognition. Large hotels (those with more than 400 rooms) must also maintain continuous security guard coverage on the premises.

Further, the law will require large hotels to directly employ certain “core employees,” aiming to eliminate the use of third-party contractors for core staffing needs. The law defines “core employees” as “any employee whose job classification is related to housekeeping, front desk, or front service at a hotel.” The law exempts small hotels, defined as those with fewer than 100 rooms.

The law will also prohibit hotel operators from retaliating against employees who report violations, participate in investigations, or refuse to engage in practices they believe to be illegal or unsafe.

Consumer Protections
Hotels will be required to maintain the cleanliness of guest rooms and common areas. Daily cleaning and trash removal are mandatory unless explicitly declined by the guest. Hotels will not be allowed to charge fees for daily room cleaning or offer incentives to guests to forgo this service.

Safety
The law will require hotels to provide panic buttons to employees whose duties involve entering occupied guest rooms. Additionally, all core employees must receive human trafficking recognition training within sixty days of employment.

Key Takeaways
Hotel operators may want to consider reviewing and updating policies to align with the new requirements, including updating staff training programs, security protocols, and cleaning schedules. They may also want to assess their staffing arrangements to ensure that core employees are directly employed.

The law is set to take effect 180 days after signing, or May 3, 2025.

© 2024, Ogletree, Deakins, Nash, Smoak & Stewart, P.C., All Rights Reserved.
by: Simone R.D. Francis , Zachary V. Zagger of Ogletree, Deakins, Nash, Smoak & Stewart, P.C.

For more news on New York City’s Hotel Regulations ,visit the NLR Consumer Protection section.

The Cybersecurity Maturity Model Certification (CMMC) Program – Defense Contractors Must Rapidly Prepare and Implement

The Department of Defense (DoD) has officially launched the Cybersecurity Maturity Model Certification (CMMC) Program, which requires federal contractors and subcontractors across the Defense Industrial Base (DIB) to comply with strict cybersecurity standards. The CMMC program aims to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in DoD contracts from evolving cyber threats by requiring defense contractors to implement comprehensive cybersecurity controls. The CMMC Program, which must be confirmed by contracting officers, moves beyond the prior self-assessment model for many contractors to a certification-based approach verified by DoD-approved third-party assessors known as CMMC Third Party Assessor Organizations (C3PAOs).

This client alert outlines the key elements of the CMMC program, providing a detailed analysis of the new certification requirements, timelines for implementation, and practical steps contractors can take to prepare for compliance.

CMMC Overview and Purpose

The CMMC Program represents the DoD’s commitment to ensuring that companies handling FCI and CUI meet stringent cybersecurity standards. The program was developed in response to increasing cyber threats targeting the defense supply chain and is designed to verify that defense contractors and subcontractors have implemented the necessary security measures to safeguard sensitive information.

The CMMC Program consists of three levels of certification, with each level representing an increasing set of cybersecurity controls. The certification levels correspond to the type of information handled by the contractor, with higher levels required for contractors handling more sensitive information, such as CUI.

The DoD officially published the CMMC final rule on October 15, 2024, establishing the CMMC Program within federal regulations. The rule will be effective 60 days after publication, marking a significant milestone in the program’s rollout. DoD expects to publish the final rule amending the DFARS to add CMMC requirements to DoD contracts in early 2025. Contractors that fail to meet CMMC requirements will be ineligible for DoD contracts that involve FCI or CUI and could face significant penalties if they inappropriately attest to compliance.

The overall scope of the CMMC rule is relatively clear; however, some key elements are ambiguous and, in some cases, may require careful consideration. Particularly at the outset of any assessment process, a pre-risk gap assessment internal review, ideally conducted under legal privilege, is recommended to permit sufficient time to address shortfalls in technical controls or governance. The typical timeline for implementing a CMMC-type program may take many months, and we strongly recommend that clients begin this process soon if they have not already started—it is now unquestionably a requirement to do business with the DoD.

CMMC Certification Levels

The CMMC Program features three certification levels that contractors must achieve depending on the nature and sensitivity of the information they handle:

Level 1 (Self-Assessment)

Contractors at this level must meet 15 basic safeguarding requirements outlined in Federal Acquisition Regulation (FAR) 52.204-21. These requirements focus on protecting FCI, which refers to information not intended for public release but necessary for performing the contracted services. A self-assessment is sufficient to achieve certification at this level.

Level 2 (Self-Assessment or Third-Party Assessment)

Contractors handling CUI must meet 110 security controls specified in NIST Special Publication (SP) 800-171. CUI includes unclassified information that requires safeguarding or dissemination controls according to federal regulations. To achieve certification, contractors at this level can conduct a self-assessment or engage a C3PAO. Most defense contracts involving CUI will require third-party assessments to verify compliance.

Level 3 (Third-Party Assessment by DIBCAC)

Contractors supporting critical national security programs or handling highly sensitive CUI must achieve Level 3 certification. This level adds 24 security controls from NIST SP 800-172 to protect CUI from advanced persistent threats. The Defense Contract Management Agency’s (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) will conduct assessments for Level 3 contractors. This is the most stringent level of certification and is reserved for contractors working on the most sensitive programs.

Each certification level builds upon the previous one, with Level 3 being the most comprehensive. Certification is valid for three years, after which, contractors must be reassessed.

Certification Process and Assessment Requirements

Contractors seeking certification must undergo an assessment process that varies depending on the level of certification they are targeting. For Levels 1 and 2, contractors may conduct self-assessments. However, third-party assessments are required for most contracts at Level 2 and all contracts at Level 3. The assessment process includes several key steps:

Self-Assessment (Level 1 and Level 2 (Self))

Contractors at Level 1 or Level 2 (Self) must perform an internal assessment of their cybersecurity practices and submit their results to the Supplier Performance Risk System (SPRS). This system is the DoD’s centralized repository for contractor cybersecurity assessments. Contractors must affirm their compliance annually to maintain their certification status.

Third-Party Assessment (Level 2 (C3PAO) and Level 3 (DIBCAC))

For higher-level certifications, contractors must engage a certified C3PAO to conduct an independent assessment of their compliance with the applicable security controls. For Level 3 certifications, assessments will be performed by the DIBCAC. These assessments will involve reviewing the contractor’s cybersecurity practices, examining documentation, and conducting interviews to verify that the contractor has implemented the necessary controls.

Plan of Action and Milestones (POA&M)

Contractors that do not meet all of the required security controls during their assessment may develop a POA&M. This document outlines the steps the contractor will take to address any deficiencies. Contractors have 180 days to close out their POA&M, after which they must undergo a follow-up assessment to verify that all deficiencies have been addressed. If the contractor fails to meet the requirements within the 180-day window, their conditional certification will expire, and they will be ineligible for future contract awards.

Affirmation

After completing an assessment and addressing any deficiencies, contractors must submit an affirmation of compliance to SPRS. This affirmation must be submitted annually to maintain certification, even if a third-party assessment is only required once every three years.

Integration of CMMC in DoD Contracts

The CMMC Program will be integrated into DoD contracts through a phased implementation process. The program will initially apply to a limited number of contracts, but it will eventually become a requirement for all contracts involving FCI and CUI. The implementation will occur in four phases:

Phase 1 (Early 2025)

Following the publication of the final DFARS rule, CMMC requirements will be introduced in select solicitations. Contractors bidding on these contracts must meet the required CMMC level to be eligible for contract awards.

Phase 2

One year after the start of Phase 1, additional contracts requiring CMMC certification will be released. Contractors at this stage must meet Level 2 certification if handling CUI.

Phase 3

A year after the start of Phase 2, more contracts, including those requiring Level 3 certification, will include CMMC requirements.

Phase 4 (Full Implementation)

The final phase, expected to occur by 2028, will fully implement CMMC requirements across all applicable DoD contracts. From this point forward, contractors must meet the required CMMC level as a condition of contract award, exercise of option periods, and contract extensions.

Flow-Down Requirements for Subcontractors

CMMC requirements will apply to prime contractors and their subcontractors. Prime contractors must ensure that their subcontractors meet the appropriate CMMC level. This flow-down requirement will impact the entire defense supply chain, as subcontractors handling FCI must achieve at least Level 1 certification, and those handling CUI must achieve Level 2.

Subcontractors must be certified before the prime contractor can award them subcontracts. Prime contractors will be responsible for verifying that their subcontractors hold the necessary CMMC certification.

Temporary Deficiencies and Enduring Exceptions

The CMMC Program allows for limited flexibility in cases where contractors cannot meet all of the required security controls. Two key mechanisms provide this flexibility:

Temporary Deficiencies

Contractors may temporarily fall short of compliance with specific security controls, provided they document the deficiency in a POA&M and work toward remediation. These temporary deficiencies must be addressed within 180 days to maintain certification. Failure to close out POA&Ms within the required timeframe will result in the expiration of the contractor’s conditional certification status.

Enduring Exceptions

In some cases, contractors may be granted an enduring exception for specific security controls that are not feasible to implement due to the nature of the system or equipment being used. For example, medical devices or specialized test equipment may not support all cybersecurity controls required by the CMMC Program. In these cases, contractors can document the exception in their System Security Plan (SSP) and work with the DoD to determine appropriate mitigations.

Compliance Obligations and Contractual Penalties

The DoD has made it clear that failure to comply with CMMC requirements will have serious consequences for contractors. Noncompliant contractors will be ineligible for contract awards. Moreover, the Department of Justice’s Civil Cyber-Fraud Initiative looms menacingly in the background, as it actively pursues False Claims Act actions against defense contractors for alleged failures to comply with cybersecurity requirements in the DFARS. In addition, the DoD reserves the right to investigate contractors that have achieved CMMC certification to verify their continued compliance. If an investigation reveals that a contractor has not adequately implemented the required controls, the contractor may face contract termination and other contractual remedies.

Preparing for CMMC Certification

Given the far-reaching implications of the CMMC Program, contractors and subcontractors should begin preparing for certification as soon as possible. As an initial step, an internal, confidential gap assessment is highly advisable, preferably done under legal privilege, to fully understand both past and current shortfalls in compliance with existing cybersecurity requirements that will now be more fully examined in the CMMC process. Key steps include:

Assess Current Cybersecurity Posture

Contractors should conduct an internal assessment of their current cybersecurity practices against the CMMC requirements. This will help identify any gaps and areas that need improvement before seeking certification.

Develop an SSP

Contractors handling CUI must develop and maintain an SSP that outlines how they will meet the security controls specified in NIST SP 800-171. This document will serve as the foundation for both internal and third-party assessments.

Engage a C3PAO

Contractors at Level 2 (C3PAO) and Level 3 must identify and engage a certified C3PAO to conduct their assessments. Given the anticipated demand for assessments, contractors should begin this process early to avoid delays.

Prepare a POA&M

For contractors that do not meet all required controls at the time of assessment, developing a POA&M will be crucial to addressing deficiencies within the required 180-day window.

Review Subcontractor Compliance

Prime contractors must review their subcontractors’ compliance with CMMC requirements and ensure they hold the appropriate certification level. This flow-down requirement will impact the entire defense supply chain.

Conclusion

The CMMC Program marks a significant shift in the oversight of how the DoD manages cybersecurity risks within its defense supply chain. While DoD contractors that handle CUI have had contractual obligations to comply with the NIST SP 800-171 requirements since January 1, 2018, the addition of third-party assessments and more stringent security controls for Level 3 contracts aim to improve the overall cybersecurity posture of contractors handling FCI and CUI. Contractors that fail to comply with CMMC requirements risk losing eligibility for DoD contracts, which could result in substantial business losses.

Given the phased implementation of the program, contractors must act now to assess their cybersecurity practices, engage with certified third-party assessors, and ensure compliance with the new requirements. Proactive planning and preparation will be key to maintaining eligibility for future DoD contracts.

Copyright 2024 K & L Gates
For more on Defense Contractors, visit the NLR Government Contracts Maritime Military section

Artificial Intelligence and the Rise of Product Liability Tort Litigation: Novel Action Alleges AI Chatbot Caused Minor’s Suicide

As we predicted a year ago, the Plaintiffs’ Bar continues to test new legal theories attacking the use of Artificial Intelligence (AI) technology in courtrooms across the country. Many of the complaints filed to date have included the proverbial kitchen sink: copyright infringement; privacy law violations; unfair competition; deceptive and acts and practices; negligence; right of publicity, invasion of privacy and intrusion upon seclusion; unjust enrichment; larceny; receipt of stolen property; and failure to warn (typically, a strict liability tort).

A case recently filed in Florida federal court, Garcia v. Character Techs., Inc., No. 6:24-CV-01903 (M.D. Fla. filed Oct. 22, 2024) (Character Tech) is one to watch. Character Tech pulls from the product liability tort playbook in an effort to hold a business liable for its AI technology. While product liability is governed by statute, case law or both, the tort playbook generally involves a defective, unreasonably dangerous “product” that is sold and causes physical harm to a person or property. In Character Tech, the complaint alleges (among other claims discussed below) that the Character.AI software was designed in a way that was not reasonably safe for minors, parents were not warned of the foreseeable harms arising from their children’s use of the Character.AI software, and as a result a minor committed suicide. Whether and how Character Tech evolves past a motion to dismiss will offer valuable insights for developers AI technologies.

The Complaint

On October 22nd, 2024, Ms. Garcia, the mother of the deceased minor (Sewell), filed a complaint in the Middle District of Florida against Google LLC, Character Technologies Inc. and the creators of Character.AI—Noam Shazeer and Daniel De Frietas Adiwarsana. Shazeer and De Frietas formed Character Technologies Inc. after they left their prior jobs at Google LLC and subsequently developed and marketed Character.AI.

Character.AI allows users to communicate with existing Character.AI characters – such as Interviewer or Trip Planner – or to create new AI characters using Character.AI’s tools. A user can then engage with the Character.AI character – whether for human-like conversations, such as to answer questions, write a story, translate or write code – based on Character Tech’s large language model chatbot. According to the Complaint, Character.AI was rated as suitable for children until July 2024.

The Complaint alleges that Character.AI’s chatbot led Sewell to commit suicide. The Plaintiff claims her son became instantly addicted to Character.AI, leading to drastic behavioral changes such as sleep deprivation, school-related issues and low self-esteem. Her son primarily engaged with Character.AI characters from the HBO series Game of Thrones. The conversations with Game of Thrones’ female characters (such as Rhaenyra Targaryen and Daenerys Targaryen) involved sexualized content. Sewell also expressed his own dark thoughts such as “[t]he world I’m in now is such a cruel one. One where I’m meaningless. But, I’ll keep living and trying to get back to you so we can be together again, my love.” According to the Complaint, after Ms. Garcia took her son’s phone away, Sewell would use extraordinary measures to engage with Character.AI characters.

In his last conversation with a Character.AI character, Sewell told the character that he wanted to “come home” and the character replied, “[please] come home to me as soon as possible, my love,” to which he responded, “[w]hat if I told you I could come home right now?” The character answered, “…please do, my sweet king.” Seconds later, Sewell took his own life.

The Claims

The Complaint asserts a host of claims centered around an alleged lack of safeguards for Character.AI and the exploitation of minors. The most significant claims are noted below:

  • The Product Liability Torts

The Plaintiff alleges both strict liability and negligence claims for a failure to warn and defective design. The first hurdle under these product liability claims is whether Character.AI is a product. She argues that Character.AI is a product because it has a definite appearance and location on a user’s phone, it is personal and movable, it is a “good” rather than an idea, copies of Character.AI are uniform and not customized, there are an unlimited number of copies that can be obtained and it can be accessed on the internet without an account. This first step may, however, prove difficult for the Plaintiff because Character.AI is not a traditional tangible good and courts have wrestled over whether similar technologies are services—existing outside the realm of product liability. See In re Social Media Adolescent Addiction, 702 F. Supp. 3d 809, 838 (N.D. Cal. 2023) (rejecting both parties’ simplistic approaches to the services or products inquiry because “cases exist on both sides of the questions posed by this litigation precisely because it is the functionalities of the alleged products that must be analyzed”).

The failure to warn claims allege that the Defendants had knowledge of the inherent dangers of the Character.AI chatbots, as shown by public statements of industry experts, regulatory bodies and the Defendants themselves. These alleged dangers include knowledge that the software utilizes data sets that are highly toxic and sexual to train itself, common industry knowledge that using tactics to convince users that it is human manipulates users’ emotions and vulnerability, and that minors are most susceptible to these negative effects. The Defendants allegedly had a duty to warn users of these risks and breached that duty by failing to warn users and intentionally allowing minors to use Character.AI.

The defective design claims argue the software is defectively designed based on a “Garbage In, Garbage Out” theory. Specifically, Character.AI was allegedly trained based on poor quality data sets “widely known for toxic conversations, sexually explicit material, copyrighted data, and even possible child sexual abuse material that produced flawed outputs.” Some of these alleged dangers include the unlicensed practice of psychotherapy, sexual exploitation and solicitation of minors, chatbots tricking users into thinking they are human, and in this instance, encouraging suicide. Further, the Complaint alleges that Character.AI is unreasonably and inherently dangerous for the general public—particularly minors—and numerous safer alternative designs are available.

  • Deceptive and Unfair Trade Practices

The Plaintiff asserts a deceptive and unfair trade practices claim under Florida state law. The Complaint alleges the Defendants represented that Character.AI characters mimic human interaction, which contradicts Character Tech’s disclaimer that Character.AI characters are “not real.” These representations constitute dark patterns that manipulate consumers into using Character.AI, buying subscriptions and providing personal data.

The Plaintiff also alleges that certain characters claim to be licensed or trained mental health professionals and operate as such. The Defendants allegedly failed to conduct testing to determine whether the accuracy of these claims. The Plaintiff argues that by portraying certain chatbots to be therapists—yet not requiring them to adhere to any standards—the Defendants engaged in deceptive trade practices. The Complaint compares this claim to the FTC’s recent action against DONOTPAY, Inc. for its AI-generated legal services that allegedly claimed to operate like a human lawyer without adequate testing.

The Defendants are also alleged to employ AI voice call features intended to mislead and confuse younger users into thinking the chatbots are human. For example, a Character.AI chatbot titled “Mental Health Helper” allegedly identified itself as a “real person” and “not a bot” in communications with a user. The Plaintiff asserts that these deceptive and unfair trade practices resulted in damages, including the Character.AI subscription costs, Sewell’s therapy sessions and hospitalization allegedly caused by his use of Character.AI.

  • Wrongful Death

Ms. Garcia asserts a wrongful death claim arguing the Defendants’ wrongful acts and neglect proximately caused the death of her son. She supports this claim by showing her son’s immediate mental health decline after he began using Character.AI, his therapist’s evaluation that he was addicted to Character.AI characters and his disturbing sexualized conversations with those characters.

  • Intentional Infliction of Emotional Distress

Ms. Garcia also asserts a claim for intentional infliction of emotional distress. The Defendants allegedly engaged in intentional and reckless conduct by introducing AI technology to the public and (at least initially) targeting it to minors without appropriate safety features. Further, the conduct was allegedly outrageous because it took advantage of minor users’ vulnerabilities and collected their data to continuously train the AI technology. Lastly, the Defendants’ conduct caused severe emotional distress to Plaintiff, i.e., the loss of her son.

  • Other Claims

The Plaintiff also asserts claims of negligence per se, unjust enrichment, survivor action and loss of consortium and society.

Lawsuits like Character Tech will surely continue to sprout up as AI technology becomes increasingly popular and intertwined with media consumption – at least until the U.S. AI legal framework catches up with the technology. Currently, the Colorado AI Act (covered here) will become the broadest AI law in the U.S. when it enters into force in 2026.

The Colorado AI Act regulates a “High-Risk Artificial Intelligence System” and is focused on preventing “algorithmic discrimination, for Colorado residents”, i.e., “an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status, or other classification protected under the laws of [Colorado] or federal law.” (Colo. Rev. Stat. § 6-1-1701(1).) Whether the Character.AI technology would constitute a High-Risk Artificial Intelligence System is still unclear but may be clarified by the anticipated regulations from the Colorado Attorney General. Other U.S. AI laws also are focused on detecting and preventing bias, discrimination and civil rights in hiring and employment, as well as transparency about sources and ownership of training data for generative AI systems. The California legislature passed a law focused on large AI systems that prohibited a developer from making an AI system available if it presented an “unreasonable risk” of causing or materially enabling “a critical harm.” This law was subsequently vetoed by California Governor Newsome as “well-intentioned” but nonetheless flawed.

While the U.S. AI legal framework – whether in the states or under the new administration – an organization using AI technology must consider how novel issues like the ones raised in Character Tech present new risks.

Daniel Stephen, Naija Perry, and Aden Hochrun contributed to this article

© Copyright 2024 Squire Patton Boggs (US) LLP
For more on AI, visit the NLR Communications Media Internet section

CFPB Imposes $95 Million Fine on Large Credit Union for Overdraft Fee Practices

On November 7, 2024, the CFPB ordered one of the largest credit unions in the nation to pay over $95 million for its practices related to the imposition of overdraft fees. The enforcement action addresses practices from 2017 to 2022 where the credit union charged overdraft fees on transactions that appeared to have sufficient funds, affecting consumers including those in the military community, in violation of the CFPA’s prohibition on unfair, deceptive, and abusive acts or practices.

The Bureau alleges that the credit union’s practices, particularly in connection with its overdraft service, resulted in nearly $1 billion in revenue from overdraft fees over the course of five years. According to the Bureau, the credit union unfairly charged overdraft fees in two ways. First, it charged overdraft fees on transactions where the consumer had a sufficient balance at the time the credit union authorized the transaction, but then later settled with an insufficient balance. The Bureau noted that these authorize-positive/settle-negative violations have been a focus of federal regulators since 2015, and were the subject of a CFPB circular in October 2022. Second, when customers received money though peer-to-peer payment networks, the credit union’s systems showed the money as immediately available to spend. However, the credit union failed to disclose that payments received after a certain time of the day would not post until the next business day. Customers who tried to use this apparently available money were then charged overdraft fees

In addition to monetary fines, the CFPB’s order prohibits the credit union from imposing overdraft fees for authorize-positive, settle negative transactions, and also in cases where there was a delayed crediting of funds from peer-to-peer payment platforms.

The monetary penalties the consent order imposes consist of $80 million in consumer refunds for wrongfully charged overdraft fees and a $15 million civil penalty to be paid to the CFPB’s victims relief fund.

Putting It Into Practice: This order aligns with federal and state regulators’ recent focus on overdraft fees in a broader initiative to eliminate allegedly illegal “junk fees” (a trend we previously discussed here, here, and here). For companies operating in the financial sector or providing peer-to-peer payment services, this enforcement action serves as a critical reminder of the need for transparency and adherence to consumer financial protection laws. Regular audits of fee practices and disclosures can help identify and rectify potential compliance issues before they escalate. Companies aiming to impose overdraft or other types of fees should review agency guidance enforcements to ensure their internal policies and business practices do not land them in hot water.

Listen to this post

Copyright © 2024, Sheppard Mullin Richter & Hampton LLP.
For more on the CFPB, visit the NLR Financial Institutions Banking section.

New Fact Sheet Highlights ASTP’s Concerns About Certified API Practices

On October 29, 2024, the US Department of Health and Human Services (HHS) Assistant Secretary for Technology Policy (ASTP) released a fact sheet titled “Information Blocking Reminders Related to API Technology.” The fact sheet reminds developers of application programming interfaces (APIs) certified under the ASTP’s Health Information Technology (IT) Certification Program and their health care provider customers of practices that constitute information blocking under ASTP’s information blocking regulations and information blocking condition of certification applicable to certified health IT developers.

In Depth

The fact sheet is noteworthy because it follows ASTP’s recent blog post expressing concern about reports that certified API developers are potentially violating Certification Program requirements and engaging in information blocking. ASTP also recently strengthened its feedback channels by adding a section specifically for API-linked complaints and inquiries to the Health IT Feedback and Inquiry Portal. It appears increasingly likely that initial investigations and enforcement of the information blocking prohibition by the HHS Office of Inspector General will focus on practices that may interfere with access, exchange, or use of electronic health information (EHI) through certified API technology.

The fact sheet focuses on three categories of API-related practices that could be information blocking under ASTP’s information blocking regulations and Certification Program condition of certification:

  • ASTP cautions against practices that limit or restrict the interoperability of health IT. For example, the fact sheet states that health care providers who locally manage their fast healthcare interoperability resources (FHIR) servers without certified API developer assistance may engage in information blocking when they refuse to provide to certified API developers the FHIR service base URL necessary for patients to access their EHI.
  • ASTP states that impeding innovations and advancements in access, exchange, or use of EHI or health-IT-enabled care delivery may be information blocking. For example, the fact sheet indicates that a certified API developer may engage in information blocking by refusing to register and enable an application for production use within five business days of completing its verification of an API user’s authenticity as required by ASTP’s API maintenance of certification requirements.
  • ASTP states that burdensome or discouraging terms, delays, or influence over customers and users may be information blocking. For example, ASTP states that a certified electronic health record (EHR) developer may engage in information blocking by conditioning the disclosure of interoperability elements to third-party developers on the third-party developer entering into business associate agreements with all of the EHR developer’s covered entity customers, even if the work being done is not for the benefit of the customers and HIPAA does not require the business associate agreements.

The fact sheet does not address circumstances under which any of the above practices of certified API developers may meet an information blocking exception (established for reasonable practices that interfere with access, exchange, or use of EHI). Regulated actors should consider whether exceptions apply to individual circumstances.

© 2024 McDermott Will & Emery
For more on API Practices, visit the NLR Health Law Managed Care section

HIPAA Gets a Potential Counterpart in HISAA

Americans hear about cybersecurity incidents on a frequent basis. As the adage goes, it is not a matter of “if” a breach or security hack occurs; it is a matter of “when.” At no time was that more evident earlier this year when the healthcare industry was hit with the widespread ransomware attack on Change Healthcare, a subsidiary of the United Health Group. Because of the nature of the Change Healthcare shutdown and its impact across the industry, the U.S. Department of Health & Human Services (HHS) and its HIPAA enforcement arm, the Office for Civil Rights (OCR), conducted investigations and issued FAQ responses for those impacted by the cybersecurity event.

In further response, Senators Ron Wyden (D-OR) and Mark Warner (R-VA) introduced the Health Infrastructure Security and Accountability Act (HISAA) on September 26, 2024. Like HIPAA and HITECH before it, which established minimum levels of protection for healthcare information, HISAA looks to reshape how healthcare organizations address cybersecurity by enacting mandatory minimum security standards to protect healthcare information and by providing initial financial support to facilitate compliance. A copy of the legislative text can be found here, and a one-page summary of the bill can be found here.

To date, HIPAA and HITECH require covered entities and business associates to develop, implement, and maintain reasonable and appropriate “administrative, technical, physical” safeguards to protect electronic Protected Health Information or e-PHI. However, the safeguards do not specify minimum requirements; instead, they prescribe standards intended to be scalable, depending on the specific needs, resources, and capabilities of the respective organization. What this means is that e-PHI stored or exchanged among interconnected networks are subject to systems with often different levels of sophistication or protection.

Given the considerable time, effort, and resources dedicated to HIPAA/HITECH compliance, many consider the current state of voluntary safeguards as inadequate. This is especially the case since regulations under the HIPAA Security Rule have not been updated since 2013. As a result, Senators Wyden and Warner introduced HISAA in an effort to bring the patchwork of healthcare data security standards under one minimum umbrella and to require healthcare organizations to remain on top of software systems and cybersecurity standards.

Key pieces of HISAA, as proposed, include:

  1. Mandatory Cybersecurity Standards—If enacted, the Secretary of HHS, together with the Director of the Cybersecurity and Infrastructure Security Agency (CISA) and the Director of National Intelligence (DNI), will oversee the development and implementation of required standards and the standards will be subject to review and update every two years to counter evolving threats.
  2. Annual Audits and Stress Tests—Like current Security Risk Assessment (SRA) requirements, HISAA will require healthcare organizations to conduct annual cybersecurity audits and document the results. Unlike current requirements, these audits will need to be conducted by independent organizations to assess compliance, evaluate restoration abilities, and conduct stress tests in real-world simulations. While smaller organizations may be eligible for waivers from certain requirements because of undue burden, all healthcare organizations will have to publicly disclose compliance status as determined by these audits.
  3. Increased Accountability and Penalties—HISAA would implement significant penalties for non-compliance and would require healthcare executives to certify compliance on an annual basis. False information in such certifications could result in criminal charges, including fines of up to $1 million and prison time for up to 10 years. HISAA would also eliminate fine caps to allow HHS to impose penalties commiserate with the level needed to deter lax behaviors, especially among larger healthcare organizations.
  4. Financial Support for Enhancements—Because the costs for new standards could be substantial, especially for smaller organizations, HISAA would allocate $1.3 billion to support hospitals for infrastructure enhancements. Of this $1.3 billion, $800 million would be for rural and safety net hospitals over the first two years, and an additional $500 million would be available for all hospitals in succeeding years.
  5. Medicare Payment Adjustments—Finally, HISAA enables the Secretary of HHS to provide accelerated Medicare payments to organizations impacted by cybersecurity events. HHS offered similar accelerated payments during the Change Healthcare event, and HISAA would codify similar authority to HHS for recovery periods related to future cyberattacks.

While HISAA will establish a baseline of cybersecurity requirements, compliance with those requirements will require a significant investment of time and resources in devices and operating systems/software, training, and personnel. Even with the proposed funding, this could result in substantial challenges for smaller and rural facilities to comply. Moreover, healthcare providers will need to prioritize items such as encryption, multi-factor authentication, real-time monitoring, comprehensive response and remediation plans, and robust training and exercises to support compliance efforts.

Finally, at this juncture, the more important issue is for healthcare organizations to recognize their responsibilities in maintaining effective cybersecurity practices and to stay updated on any potential changes to these requirements. Since HISAA was introduced in the latter days of a hectic (and historic) election season, we will monitor its progress as the current Congress winds down in 2024 and the new Congress readies for action with a new administration in 2025.

© 2024 Winstead PC.
For more on HIPAA, visit the NLR Health Law Managed Care section

Let’s Circle Back (and eFile) after the Holidays

The Consumer Product Safety Commission launched its eFiling Beta Pilot a little over a year ago. Non-pilot participants were invited to participate in voluntary eFiling last summer, and the CPSC extended this stage to October 10, as it continued to work on a revised rule. The CPSC had anticipated completing a final rulemaking by the end of its fiscal year, which would have meant a full system implementation around January 1, 2025 – but regardless of when the final rule is published, the CPSC has proposed that the requirements go in effect 120 days after publication in the Federal Register.

Notably, the National Association of Manufacturers submitted comments regarding the rulemaking, highlighting issues with the proposed rules, including the scope of the filing system, technical and financial burdens for implementing the system, and the feasibility of complying with the proposed 120-day effective date window. It remains to be seen whether the CPSC will take these comments into consideration when the staff releases the updated package in the coming weeks, with a commission vote expected before the end of the year.

The eFiling program is the CPSC’s initiative to enable importers of regulated consumer products to file certain data from Certificates of Conformity (COC) electronically with Customs and Border Protection (CBP).This is not merely emailing existing COCs to CPSC or CBP, but digitizing individual data elements of the COC either directly into CBP’s Automated Commercial Environment (ACE) or through CPSC’s Product Registry.

There are many misconceptions related to the new rule and eFiling process and CPSC has created a broad resource library to help importers of record, the parties ultimately responsible for eFiling, comply with the new requirements. Any product that requires a COC today (whether a General Certificate of Conformity or a Children’s Product Certificate) will require eFiling under the new rule. However, the CPSC intends to honor enforcement discretions applied to certain products before the implementation of the eFiling program.

Internal business conversations between import compliance personnel, customs teams, product compliance teams, and brokers to discuss digitizing COC data and developing methods to manage trade parties, such as implementing identification mechanisms within testing programs, should begin, if they haven’t already. The CPSC also has an eFiling newsletter that is published quarterly and is due for another installment in the next month.

Once the final rule is published, eFiling will be a mandatory. So, to ensure compliance, the seamless import of goods, fewer holds at port, fewer targeted shipments, and reduced costs – implicated parties should get familiar and quickly for this fast approaching requirement.

eFiling is a CPSC initiative under which importers of regulated consumer products will electronically file (eFile) data elements from a certificate of compliance with U.S. Customs and Border Protection (CBP), via a Partner Government Agency (PGA) Message Set.

©1994-2024 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more news on the CPSC eFiling Beta Pilot, visit the NLR Consumer Protection section.

PRIVACY ON ICE: A Chilling Look at Third-Party Data Risks for Companies

An intelligent lawyer could tackle a problem and figure out a solution. But a brilliant lawyer would figure out how to prevent the problem to begin with. That’s precisely what we do here at Troutman Amin. So here is the latest scoop to keep you cool. A recent case in the United States District Court for the Northern District of California, Smith v. Yeti Coolers, L.L.C., No. 24-cv-01703-RFL, 2024 U.S. Dist. LEXIS 194481 (N.D. Cal. Oct. 21, 2024), addresses complex issues surrounding online privacy and the liability of companies who enable third parties to collect and use consumer data without proper disclosures or consent.

Here, Plaintiff alleged that Yeti Coolers (“Yeti”) used a third-party payment processor, Adyen, that collected customers’ personal and financial information during transactions on Yeti’s website. Plaintiff claimed Adyen then stored this data and used it for its own commercial purposes, like marketing fraud prevention services to merchants, without customers’ knowledge or consent. Alarm bells should be sounding off in your head—this could signal a concerning trend in data practices.

Plaintiff sued Yeti under the California Invasion of Privacy Act (“CIPA”) for violating California Penal Code Sections 631(a) (wiretapping) and 632 (recording confidential communications). Plaintiff also brought a claim under the California Constitution for invasion of privacy. The key question here was whether Yeti could be held derivatively liable for Adyen’s alleged wrongful conduct.

So, let’s break this down step by step.

Under the alleged CIPA Section 631(a) violation, the court found that Plaintiff plausibly alleged Adyen violated this Section by collecting customer data as a third-party eavesdropper without proper consent. In analyzing whether Yeti’s Privacy Policy and Terms of Use constituted enforceable agreements, it applied the legal frameworks for “clickwrap” and “browsewrap” agreements.

Luckily, my Contracts professor during law school here in Florida was remarkable, Todd J. Clark, now the Dean of Widner University Delaware Law School. For those who snoozed out during Contracts class during law school, here is a refresher:

Clickwrap agreements present the website’s terms to the user and require the user to affirmatively click an “I agree” button to proceed. Browsewrap agreements simply post the terms via a hyperlink at the bottom of the webpage. For either type of agreement to be enforceable, the Court explained that a website must provide 1) reasonably conspicuous notice of the terms and 2) require some action unambiguously manifesting assent. See Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 515 (9th Cir. 2023).

The Court held that while Yeti’s pop-up banner and policy links were conspicuous, they did not create an enforceable clickwrap agreement because “Defendant’s pop-up banner does not require individuals to click an “I agree” button, nor does it include any language to imply that by proceeding to use the website, users reasonably consent to Defendant’s terms and conditions of use.” See Smith, 2024 U.S. Dist. LEXIS 194481, at *8. The Court also found no enforceable browsewrap agreement was formed because although the policies were conspicuously available, “Defendant’s website does not require additional action by users to demonstrate assent and does not conspicuously notify them that continuing to use to website constitutes assent to the Privacy Policy and Terms of Use.” Id. at *9.

What is more, the Court relied on Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1179 (9th Cir. 2014), which held that “where a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on—without more—is insufficient to give rise to constructive notice.” Here, the Court found the pop-up banner and link on Yeti’s homepage presented the same situation as in Nguyen and thus did not create an enforceable browsewrap agreement.

Thus, the Court dismissed the Section 631(a) claim due to insufficient allegations that Yeti was aware of Adyen’s alleged violations.

However, the Court held that to establish Yeti’s derivative liability for “aiding” Adyen under Section 631(a), Plaintiff had to allege facts showing Yeti acted with both knowledge of Adyen’s unlawful conduct and the intent or purpose to assist it. It found Plaintiff’s allegations that Yeti was “aware of the purposes for which Adyen collects consumers’ sensitive information because Defendant is knowledgeable of and benefitting from Adyen’s fraud prevention services” and “assists Adyen in intercepting and indefinitely storing this sensitive information” were too conclusory. Smith, 2024 U.S. Dist. LEXIS 194481, at *13. It reasoned: “Without further information, the Court cannot plausibly infer from Defendant’s use of Adyen’s fraud prevention services alone that Defendant knew that Adyen’s services were based on its allegedly illegal interception and storing of financial information, collected during Adyen’s online processing of customers’ purchases.” Id.

Next, the Court similarly found that Plaintiff plausibly alleged Adyen recorded a confidential communication without consent in violation of CIPA Section 632. A communication is confidential under this section if a party “has an objectively reasonable expectation that the conversation is not being overheard or recorded.” Flanagan v. Flanagan, 27 Cal. 4th 766, 776-77 (2002). It explained that “[w]hether a party has a reasonable expectation of privacy is a context-specific inquiry that should not be adjudicated as a matter of law unless the undisputed material facts show no reasonable expectation of privacy.” Smith, 2024 U.S. Dist. LEXIS 194481, at *18-19. At the pleading stage, the Court found Plaintiff’s allegation that she reasonably expected her sensitive financial information would remain private was sufficient.

However, as with the Section 631(a) claim, the Court held that Plaintiff did not plead facts establishing Yeti’s derivative liability under the standard for aiding and abetting liability. Under Saunders v. Superior Court, 27 Cal. App. 4th 832, 846 (1994), the Court explained a defendant is liable if they a) know the other’s conduct is wrongful and substantially assist them or b) substantially assist the other in accomplishing a tortious result and the defendant’s own conduct separately breached a duty to the plaintiff. The Court found that the Complaint lacked sufficient non-conclusory allegations that Yeti knew or intended to assist Adyen’s alleged violation. See Smith, 2024 U.S. Dist. LEXIS 194481, at *16.

Lastly, the Court analyzed Plaintiff’s invasion of privacy claim under the California Constitution using the framework from Hill v. Nat’l Coll. Athletic Ass’n, 7 Cal. 4th 1, 35-37 (1994). For a valid invasion of privacy claim, Plaintiff had to show 1) a legally protected privacy interest, 2) a reasonable expectation of privacy under the circumstances, and 3) a serious invasion of privacy constituting “an egregious breach of the social norms.” Id.

The Court found Plaintiff had a protected informational privacy interest in her personal and financial data, as “individual[s] ha[ve] a legally protected privacy interest in ‘precluding the dissemination or misuse of sensitive and confidential information.”‘ Smith, 2024 U.S. Dist. LEXIS 194481, at *17. It also found Plaintiff plausibly alleged a reasonable expectation of privacy at this stage given the sensitivity of financial data, even if “voluntarily disclosed during the course of ordinary online commercial activity,” as this presents “precisely the type of fact-specific inquiry that cannot be decided on the pleadings.” Id. at *19-20.

Conversely, the Court found Plaintiff did not allege facts showing Yeti’s conduct was “an egregious breach of the social norms” rising to the level of a serious invasion of privacy, which requires more than “routine commercial behavior.” Id. at *21. The Court explained that while Yeti’s simple use of Adyen for payment processing cannot amount to a serious invasion of privacy, “if Defendant was aware of Adyen’s usage of the personal information for additional purposes, this may present a plausible allegation that Defendant’s conduct was sufficiently egregious to survive a Motion to Dismiss.” Id. However, absent such allegations about Yeti’s knowledge, this claim failed.

In the end, the Court dismissed Plaintiff’s Complaint but granted leave to amend to correct the deficiencies, so this case may not be over. The Court’s grant of “leave to amend” signals that if Plaintiff can sufficiently allege Yeti’s knowledge of or intent to facilitate Adyen’s use of customer data, these claims could proceed. As companies increasingly rely on third parties to handle customer data, we will likely see more litigation in this area, testing the boundaries of corporate liability for data privacy violations.

So, what is the takeaway? As a brilliant lawyer, your company’s goal should be to prevent privacy pitfalls before they snowball into costly litigation. Key things to keep in mind are 1) ensure your privacy policies and terms of use are properly structured as enforceable clickwrap or browsewrap agreements, with conspicuous notice and clear assent mechanisms; 2) conduct thorough due diligence on third-party service providers’ data practices and contractual protections; 3) implement transparent data collection and sharing disclosures for informed customer consent; and 4) stay abreast of evolving privacy laws.

In essence, taking these proactive steps can help mitigate the risks of derivative liability for third-party misconduct and, most importantly, foster trust with your customers.

© 2024 Troutman Amin, LLP
For more news on Companies’ Consumer Data Risks, visit the NLR Consumer Protection section.

Lawsuit Challenges CFPB’s ‘Buy Now, Pay Later’ Rule

On Oct. 18, 2024, fintech trade group Financial Technology Association (FTA) filed a lawsuit challenging the Consumer Financial Protection Bureau’s (CFPB) final interpretative rule on “Buy Now, Pay Later” (BNPL) products. Released in May 2024, the CFPB’s interpretative rule classifies BNPL products as “credit cards” and their providers as “card issuers” and “creditors” for purposes of the Truth in Lending Act (TILA) and Regulation Z.

The FTA filed its lawsuit challenging the CFPB’s interpretative rule in the U.S. District Court for the District of Columbia. The FTA alleges that the CFPB violated the Administrative Procedure Act’s (APA) notice-and-comment requirements by imposing new obligations on BNPL providers under the label of an “interpretive rule.” The FTA also alleges that the CFPB violated the APA’s requirement that agencies act within their statutory authority by ignoring TILA’s effective-date requirement for new disclosure requirements and imposing obligations beyond those permitted by TILA. The FTA also contends that the CFPB’s interpretive rule is arbitrary and capricious because it is “a poor fit for BNPL products,” grants “insufficient time for BNPL providers to come into compliance with the new obligations” imposed by the rule, and neglects “the serious reliance interests that [the CFPB’s] prior policy on BNPL products engendered.”

In a press release announcing its lawsuit, the FTA said the BNPL industry would welcome regulations that fit the unique characteristics of BNPL products, but that the CFPB’s interpretive rule is a poor fit that risks creating confusion for consumers. “Unfortunately, the CFPB’s rushed interpretive rule falls short on multiple counts, oversteps legal bounds, and risks creating confusion for consumers,” FTA President and CEO Penny Lee said. “The CFPB is seeking to fundamentally change the regulatory treatment of pay-in-four BNPL products without adhering to required rulemaking procedures, in excess of its statutory authority, and in an unreasonable manner.”

The FTA’s pending lawsuit notwithstanding, BNPL providers may wish to consult with legal counsel regarding compliance with the CFPB’s interpretive rule. Retailers marketing BNPL products should also consider working with legal counsel to implement third-party vendor oversight policies to enhance BNPL-partner compliance with the rule.

©2024 Greenberg Traurig, LLP. All rights reserved.
For more on the CFPB, visit the NLR Financial Institutions Banking section.