What Is Federal Trade Commission Act, Section 5?
Section 5 of the Federal Trade Commission Act prohibits 'unfair or deceptive acts or practices in or affecting commerce.' It is an important federal enforcement tool for privacy practices that fall within FTC jurisdiction, including deceptive privacy promises and certain unfair data-security or data-use practices. Deception generally concerns a material representation, omission, or practice likely to mislead a reasonable consumer acting reasonably. Unfairness concerns practices that cause or are likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits. The FTC's authority remains subject to statutory jurisdiction and remedy limits. Section 5 itself does not create a general individual privacy right or a private right of action.
At a glance
- Full name
- Federal Trade Commission Act, Section 5
- Short code
- FTC Act §5
- Enacted
- 1914
- Last major update
- Magnuson-Moss 1975 (rulemaking authority); civil penalty authority ongoing
- Jurisdiction
- United States (federal)
- Private right of action
- No
- Primary enforcer
- Federal Trade Commission (Bureau of Consumer Protection, Division of Privacy and Identity Protection)
- Statutory citation
- 15 U.S.C. § 45
Scope, who FTC Act §5 covers
Protected data
Consumer rights & protections
No direct consumer rights. Section 5 grants enforcement authority, not individual rights
Consumers benefit indirectly through FTC consent decrees that often include disclosure requirements, monitoring, and algorithmic disgorgement
The FTC Consumer Response Center accepts privacy complaints (which inform enforcement priorities but do not guarantee individual action)
Notable features
Section 5 is flexible: the FTC has used it in cases involving privacy promises, data security, sensitive data, and derived models. Some orders require deletion or model/algorithm restrictions, long-term compliance reporting, or security programs, but remedies and duration depend on the particular order. Section 5 does not prescribe one technical security standard for every business.
Enforcement & penalties
Enforcing agency: Federal Trade Commission (Bureau of Consumer Protection, Division of Privacy and Identity Protection)
Penalties: The FTC's available remedies depend on the authority used. A standalone Section 5 case generally does not carry a civil penalty for a first violation of Section 5 itself, while violations of FTC rules, prior orders, or other statutory provisions can create different penalty exposure. Orders may also seek redress, deletion of unlawfully obtained data or derived models in appropriate cases, disclosures, and monitoring. Check the current FTC authority and order for the remedy actually available.
Private right of action: Section 5 has no private right of action. Consumers harmed by unfair or deceptive practices must rely on state consumer-protection laws (often modeled on Section 5) or state common-law claims. State AGs can bring Section 5-equivalent claims under their own statutes.
Landmark enforcement cases
FTC v. Kochava
2026The FTC's current case page lists the matter as pending and records a June 26, 2026 stipulated order for injunction and other relief. The case concerns allegations about sensitive location data; consult the current case docket for the operative status and terms rather than relying only on the original complaint.
Official source →FTC v. X-Mode Social / Outlogic
2024X-Mode (rebranded as Outlogic) agreed to a settlement barring sale of sensitive location data after FTC alleged unfair practices in selling precise location data that could identify visits to sensitive places. First FTC action that banned a data broker from specific geolocation data sales.
Official source →FTC v. Avast
2024Avast agreed to pay $16.5M and delete web-browsing information transferred to Jumpshot plus products or algorithms derived from that data. The FTC alleged Avast collected browsing data through browser extensions and antivirus software and sold it to more than 100 third parties despite promising privacy protection.
Official source →FTC v. Cambridge Analytica
2019The FTC order required deletion of data and any algorithms, models, or work product derived from data improperly collected via Facebook.
Official source →Relevance to data brokers
Section 5 is one federal route the FTC may use when a data broker's conduct falls within FTC jurisdiction and involves deception or unfairness. The agency has brought matters involving sensitive location data, browsing data, and privacy or security representations, but an enforcement example does not establish that every broker or practice violates Section 5. Check the specific complaint, order, and applicable sectoral or state law.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
Frequently Asked Questions
What is the difference between 'deception' and 'unfairness' under Section 5?
+
Deception: a material representation, omission, or practice likely to mislead a reasonable consumer (e.g., saying you don't sell data while selling it). Unfairness: a practice that causes or is likely to cause substantial injury to consumers, not reasonably avoidable by consumers, and not outweighed by countervailing benefits (e.g., selling geolocation data that exposes visits to reproductive health clinics).
Can I file a Section 5 complaint with the FTC?
+
Yes. Report privacy violations at reportfraud.ftc.gov. A complaint does not guarantee individual relief or an FTC investigation, but it may inform the agency's enforcement priorities and broader inquiries.
What is algorithmic disgorgement?
+
A remedy the FTC has used since 2019 (Cambridge Analytica) requiring companies to delete not just unlawfully obtained data but also any algorithms, models, or products built using that data. Notable uses: Everalbum (2021) facial-recognition model, WW International (2022), Rite Aid (2023) facial-recognition system, Avast (2024).
Does Section 5 apply to nonprofits?
+
Section 5 generally exempts nonprofits, but the FTC has asserted jurisdiction over nonprofits engaged in commercial activities (e.g., when a nonprofit sells data or services). This is narrower than state consumer-protection laws, several of which cover nonprofits outright.
Official sources & citations
Other federal privacy laws
Federal privacy law is sectoral, each statute covers a specific data type or industry. Here are the other federal regimes to know alongside FTC Act §5: