State UDAP & the FTC Act: when practice contradicts the promise.
A privacy policy or consent banner that says one thing while the site does another supports deceptive-practice claims, and weakens the insured’s defense against everything else.
The law in brief.
State unfair and deceptive acts and practices (UDAP) laws and Section 5 of the FTC Act
State attorneys general, the FTC and, under many state laws, private plaintiffs
Actual damages; statutory minimums in some states ($100–$500 per violation); treble damages in some
No
The company’s privacy representations were deceptive
What creates the exposure.
Tracking that continues after Reject All
Consent Failure →
Undisclosed data-broker flows
Data Brokerage & Sharing →
Opt-out signals that aren’t honored
Consent & Preference Signals →
A privacy policy that omits or contradicts the tracking
Promise versus practice.
Report indicators
Risks tied to this law
- Pixel firing despite Reject All
- Advertising tracking despite opt-out selection
- Data broker interaction
- Global Privacy Control signal not honored
Pixel firing despite Reject-All selection
Example finding. Vendor names are withheld.
How to respond.
“When was the privacy policy last checked against what the site actually does?”
“Who manages the consent tool?”
“Align the consent manager and privacy policy with observed site behavior, verified by CyRisk rescan.”
Wrongful-collection and regulatory terms; deceptive-practice findings weaken defenses on other claims.
Keep exploring.
Exposure families behind this law
Other laws
How does CyRisk compare policy and practice?
It reads the privacy policies it finds and compares them with the tracking it observes. Findings tagged Policy show where they diverge.
Why does a policy gap matter if there’s no other claim?
It supports deceptive-practice claims on its own and undercuts the insured’s defense against wiretap and privacy claims.
Who brings these claims?
State attorneys general, the FTC and, under many state laws, private plaintiffs.
Check the promise against the practice.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.