FTC Act section 5: privacy and security claims

The rule

In the United States there is no single federal privacy statute that covers every website. For the claims a company makes about privacy and security, the main federal tool is section 5 of the Federal Trade Commission Act.

The statute does not define deception. The FTC’s 1983 Policy Statement on Deception does, and the FTC has applied it to privacy and security claims since.

Apply that to a website. A sentence such as “we never share your data with third parties” or “your information is 100% confidential” is an express claim, so its meaning is what it says. If the site sends visitor data to an advertising platform, the claim is open to being tested against that fact.

Penalties work differently from the GDPR, and the text should be read carefully. Section 5(l) provides that a party that disobeys a final Commission order “shall forfeit and pay to the United States a civil penalty of not more than $10,000 for each violation”. Each day of a continuing failure counts separately. The figure is the statute’s base amount and is adjusted over time, so the current number should be checked. For a first false claim the usual result is an order that binds the company for years, which can then carry penalties if it is not followed. Money can also arise through a settlement or a referral to the Department of Justice, as in the Monument matter below, where the penalty rests on a different statute.

What PeekWell checks and how

US-07 asks, for each privacy or security claim on a public page, whether something the browser did contradicts it. It looks only for literal contradiction with evidence attached. Claims that a browser cannot test are read but not flagged.

The scan reads the pages it visits, including the privacy policy, and a language model extracts affirmative claims such as “we never share”, “bank-level encryption” or “HIPAA-compliant”. For the claims that map to something observable, code runs a test. The spec’s examples are “encrypted” against the TLS actually in use, and “no third-party sharing” against the trackers the browser recorded in a clean visit. The method is the same one EU-05 uses against the GDPR’s transparency rule, applied here to the claims themselves.

The decision is made by code from the evidence. The model reads the claim and helps write the explanation. It never asserts that a claim is false. Severity starts at high and is strongest when a specific claim is contradicted.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. It is not a security test and cannot confirm what encryption a company uses on a server, who has access to a database or whether a standard was met. A claim like “HIPAA-compliant” can be read and quoted in a report, but no browser visit can confirm or refute it. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site’s claims are accurate.

Why it matters for a company

The FTC’s recent privacy and security cases lean on a company’s own words. In each of the three below, the FTC alleged that the company’s statements did not match what it was doing.

Zoom is the cleanest example of a security claim. The FTC alleged in 2020 that Zoom had advertised “end-to-end, 256-bit encryption” while holding the keys that let it reach meeting content, and that it had said recorded meetings were encrypted right after they ended when some stayed unencrypted for up to 60 days. The settlement announced on 9 November 2020 would require a security program and bar misrepresentation of privacy and security practices. It was subject to public comment, and the press release states no money. The Commission voted 3-2, with two commissioners dissenting.

GoDaddy followed in 2025. The FTC alleged the company claimed “award-winning security” while failing to use multi-factor authentication, to monitor for security threats and to secure connections to consumer data. It also alleged deception about compliance with the Privacy Shield frameworks. The order, finalized on 21 May 2025 by a 3-0 vote, bars misrepresentation of security and of compliance with any government, self-regulatory or standard-setting program. It requires a security program and an independent assessor.

Monument, in 2024, is a promise about confidentiality. The FTC’s complaint says that from 2020 to 2022 Monument told users their personal information would be “100% confidential” and not disclosed to third parties without consent, and said it complied with HIPAA, when an outside assessor had found it had not fully complied. The complaint alleges that it shared health details with advertising platforms, for as many as 84,000 users. The proposed order, as announced on 11 April 2024 and filed by the Department of Justice, would carry a $2.5 million civil penalty under a separate statute, the Opioid Addiction Recovery Fraud Prevention Act, suspended because of Monument’s inability to pay.

Three things follow for a company. Marketing copy counts: the claims in these cases were on a website or in consumer communications, not in a contract. A statement of a standard or a program, such as Privacy Shield, is a claim in its own right. And an order outlasts the case, since a company that has agreed to one is then measured against it.

Smaller companies and larger companies

Section 5 has no size threshold, and the Monument case shows it reaches a small firm. What differs is how the gap forms.

In a smaller company a founder or a marketer writes the reassuring lines: “bank-level security”, “we never sell your data”, “fully HIPAA-compliant”. They are written to win trust, often copied from another company’s page or a template. Then the site gets the usual tools, an analytics script, an ad pixel, a session recorder, and nobody checks the new tool against the old promise. The Monument complaint describes how that can go in a small health service, where the claim was “100% confidential” and the pixels sent health details to ad platforms.

In a larger company the claim often comes from brand or product marketing (“award-winning security”), while the practice sits with security, engineering and vendors. Nobody owns the question of whether the two agree. GoDaddy is the example in the sources: the claim was about the company as a whole, and the allegations concerned specific practices that did not match it.

How to fix it

Treat every privacy or security sentence on the site as something you can be asked to prove, and keep the proof close to the sentence.

1. Collect the claims. Search the site, the privacy policy, the checkout and the app store text for “secure”, “encrypted”, “never”, “confidential”, “private” and “compliant”. Put each sentence in a list with the page it sits on.
2. Test the ones you can. For “encrypted”, confirm every page and form posts over HTTPS and note what covers data at rest. For “we never share”, open the site in a private window with the network tab open and list every third-party request. Do it again after accepting the banner.
3. Reword to what is true and specific. Replace “bank-level” or “military-grade” with what you do, for example “data is encrypted in transit with TLS and at rest with AES-256”, if that is the case. Replace “we never share” with who receives what, and why.
4. Remove or gate what you cannot back up. If an ad pixel contradicts “we do not share”, either remove the pixel, or load it only after consent and change the claim to describe it. Drop a standard or program badge you cannot support.
5. Give each claim an owner. Name who should re-check the list when a tool is added, a vendor changes or the policy is edited. Put the check in the release checklist.
6. Re-scan. Run a scan again after the changes. The finding should disappear once no stated claim is contradicted by what the browser did.

Whether a reworded claim holds up with the FTC or a state authority is a question for your legal adviser. Peeky reports only what it sees.