Consumers Affected
40,000,000
The FTC finalized an order against Chegg Inc. for failing to secure student data, leading to breaches that exposed personal information of about 40 million users and employees. Chegg must implement a comprehensive security program, limit data collection, offer multifactor authentication, and allow data access and deletion.
Chegg is required to implement a comprehensive information security program, limit the data it collects and retains, provide multifactor authentication to users, and allow users to request access to and deletion of their data.
In-house legal teams should review all vendor and customer agreements, particularly those with educational institutions or directly with students/parents, for clauses governing data security, breach notification, data minimization, and user rights. Specific clauses to scrutinize include data security requirements, encryption standards, password management, data retention and deletion policies, and provisions allowing user access or deletion requests. Given the order's focus on limiting data collection and offering multifactor authentication, contracts may need amendments to mandate MFA for account access, impose stricter data collection and retention limits, require robust encryption (including for stored data and passwords), and establish clear processes for user data access and deletion requests. Employment agreements handling employee personal and medical information should also be reviewed for adequate data protection safeguards.
Entity
Chegg Inc.
Also known as: Chegg
Industry
EducationOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2023/01/ftc-finalizes-order-ed-tech-provider-chegg-lax-security-exposed-student-data
Chegg DecisionandOrder
https://www.ftc.gov/system/files/ftc_gov/pdf/Chegg-DecisionandOrder.pdf
ftc brings action against ed tech provider chegg careless se
https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-brings-action-against-ed-tech-provider-chegg-careless-security-exposed-personal-data-millions
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"Chegg Inc."
"careless data security practices"
"Exposed Student Data"
"medical information about Chegg employees"
"about 40 million users and employees"
$750K
The FTC finalized an order against Vanilla Chip LLC (doing business as TruHeight) and its principals for deceptively advertising height-enhancing supplements for children and teens without scientific evidence. The company also used fake reviews and incentivized 5-star ratings. The order requires a $750,000 payment and prohibits false health claims and deceptive review practices.
$2.3M
The FTC alleged that RentGrow, a tenant screening company, violated the Fair Credit Reporting Act (FCRA) by failing to use reasonable procedures to ensure the accuracy of its reports, including by reporting duplicate records and failing to disclose data sources. RentGrow agreed to pay a $2.25 million penalty and is prohibited from further FCRA violations and from misrepresenting dispute outcomes.
The FTC and New York Attorney General took action against Handy Technologies for deceptive earnings claims and failure to disclose fees and fines that led to millions of dollars being withheld from workers' wages. The FTC is sending over $2.7 million in refunds to 62,893 affected consumers.
$35.0M
The FTC alleged that Hopper, a travel booking app, charged consumers hidden and pre-selected fees (Tip and VIP Support) without their consent, misrepresented the benefits of VIP Support and Price Freeze services, and failed to clearly disclose total prices. Hopper agreed to pay $35 million for consumer redress and is prohibited from misrepresenting fees under a proposed order.
$1.5M
The FTC finalized a settlement with Publishing.com LLC and its principals for misleading consumers about potential earnings from self-publishing products. The company will pay $1.5 million and is prohibited from making unsubstantiated earnings claims, failing to disclose refund terms, and misrepresenting endorsements and reviews.
The FTC is seeking public comment on a proposed policy statement addressing concerns that AI companies may be manipulating AI system outputs contrary to consumer expectations for objectivity and accuracy. The statement explains that such conduct could be considered deceptive under Section 5 of the FTC Act. The public comment period runs until July 31, 2026.