The Federal Trade Commission's GoodRx case has properly gotten a lot of attention because of its "first of a kind" enforcement action under the Health Breach Notification Rule. (Check out my colleague Bram Schumer's excellent post about this, which discusses the privacy implications of this case in detail.) An aspect of GoodRx that hasn't gotten as much attention -- that is of great importance to advertisers as well -- are the allegations in the case related to the company's claims that it was in compliance with Digital Advertising Alliance principles.
In the complaint, the FTC alleges that GoodRx promised users that it would ensure the confidentiality of personal health information that it disclosed to third parties. In connection with that, the company claimed that, "GoodRx adheres to Digital Advertising Alliance principles." The DAA's principles prohibit the use of sensitive data -- such as drug prescriptions or medical records -- for online behavioral advertising without the user's consent. The FTC alleged that, notwithstanding its claim that it complies with these principles, GoodRx, in fact, violated the principles "when it used personal health information to target users with health-related advertisements on the Facebook and Instagram platforms without obtaining users' affirmative express consent." This, the FTC charged, was a false or misleading statement that violates the FTC Act's prohibition on deceptive acts or practices.
Why is this an important development for advertisers generally to pay attention to? Here, the advertiser promoted that it was in compliance with voluntary standards. Once an advertiser promotes that it is complying with voluntary standards, however, it suddenly turns those voluntary standards into standards that the advertiser is, essentially, legally obligated to comply with. That's because, once you advertise that you're in complying with those standards, if you're not, then the FTC's position is that you're engaging in false advertising.
This isn't the first time that the FTC has taken this position. In 2019, for example, the FTC investigated Canada Goose over claims that appeared to be based on the company's claims that it complied with voluntary animal treatment standards.
As companies increasingly try to show consumers how they well treat their workers, how they are reducing their adverse impact on the environment, what their values are, and what they generally stand for, they've often promoting their compliance with voluntary standards. Just remember, however, that once you do that, these aren't voluntary standards any more. Your promise that you're complying with those standards is an advertising claim like any other that must be truthful, not misleading, and fully substantiated.
"It also falsely claimed that it complied with the Digital Advertising Alliance principles, which require companies to get consent before using health information for advertising"
unknownx500
