Chris Allen (00:00)

Welcome to the fifth season of State AG Pulse. In this season, we’ll be digging into the weekly State AG News to bring you our insights on the impact of state attorneys general across a broad range of industry sectors. From technology to healthcare and telecommunications to consumer financial services, state attorneys general continue to wield extraordinary influence, not only in their own states, but also on the national stage. Now on to this week’s episode.

Hello and welcome back to State AG Pulse. At least I hope it’s welcome back. For those of you joining us the first time, welcome to State AG Pulse. My name is Chris Allen. I am a partner in Cozen O’Connor’s State AG Group, and I am joined today by my great associate, Emily Yu. Hi Emily, welcome back.

Emily Yu (00:50)

Hi Chris, thanks for having me back. Always a pleasure to be on here with you.

Chris Allen (00:54)

Always a pleasure to have you on and hear your thoughts. So last time we talked, I talked to Hannah about the massive $1.4 billion Google data privacy settlement.  And we talked about some of the ramifications of that for clients, as well as the way that that casts a mirror on the AG community and their enforcement priorities as enforcers.

This time we’re not going to talk about a specific settlement. We’re going to talk about something a specific AG is doing. But I think it’s going to be a useful lens in understanding how AGs view their roles, how AGs view their current, the current state of federal regulation and moving to fill perceived gaps. And also some of the topics that are really gaining AG attention in terms of consumer protection. So, without further ado, Emily, the Empire State, Tish James, her office has proposed and gotten sponsors for a bill, the Fostering Affordability and Integrity through Reasonable Business Practices Act or the FAIR Business Practices Act, because every law has to have an acronym these days, which is intended to be a significant amendment to New York’s existing consumer protection law.

We talked about in some states, those are called UDAPs, some states call them the CPA.In New York, it’s General Business Law Section 349. Emily, what is AG James proposing and what is the legislature thinking about?

Emily Yu (02:31)

I would say the main amendment that’s being proposed by the FAIR Business Practices Act is making unfair and abusive acts and practices also unlawful in New York, which is something that is already prohibited in 42 other states and federal laws. For example, it provides protections for businesses that may be alleged victims of unlawful business practices.

It allows conduct that doesn’t have public impact actionable under this law. And it also covers conduct that happens outside of New York. These are all things that are already unlawful in most other states and under federal law that with the FAIR Business Practices Act will also be unlawful under New York law. And yeah, I think nothing truly groundbreaking in what is in the legislation itself, but from the announcement from Attorney General James’ office, we can see that perhaps some of the contemplated applications of this law might be new and novel.

Chris Allen (03:43)

What do mean by that?

Emily Yu (03:46)

So, in the press release from the AG’s office, there is extensive mention of using these amendments to New York’s UDAP law to act on things such as junk fees, AI-based schemes, phishing, subscriptions that have tricky cancellation policies. These are all things that we’re seeing recently, more and more enforcement under state UDAP laws that are just now coming to the forefront. So even though the FAIR Business Practices Act is bringing New York’s UDAP law in line with how a lot of other states’ laws already read, it appears that some of the applications that Attorney General James is thinking of using this law for enforcement purposes, some of those topic areas are still emerging areas in consumer protection.

Chris Allen (04:41)

Yeah, so to be clear, the law itself doesn’t talk about things like dark patterns or cancellation or junk fees or things like that. Rather, what it does is it the proposed legislation expands and updates the New York general business code in order to allow the AG to explicitly reach those kinds of alleged misconduct.

Emily Yu

Correct.

Yeah. And it’s interesting also the language there that it adds both unfair and abusive because that mirrors very, very closely if not exactly the language in Dodd-Frank, which [prohibit] allows the CFPB to regulate, I think it’s deceptive, unfair or abusive practices. And, you know, most UDAP statutes prohibit deceptive or unfair practices. New York is a little bit of an outlier there, as you pointed out, “unfair” being a broader concept that AGs have used to get at things like data breaches, for example, back before they had data breach notification laws.  And “abusive” is a more interesting standard because the, if I remember correctly, the definition that generally has built up around there has to do with leveraging information disparities between the company that’s offering the product and the consumer that’s getting it.

So in other words, you could disclose everything, you could not omit anything, but if the disclosures are not done in a specific way, or they’re not done in a clear way, it could nevertheless constitute a violation of New York consumer protection laws under the proposed definition.

Emily Yu (06:10)

Adding on to your note that this new abusive definition closely mirrors what the CFPB already has, I wanted to also mention that in January, before the transition and administration, Biden and CFPB had put out a report titled “Strengthening State Level Consumer Protections”. And within that report are a lot of recommendations for how states can further beef up their UDAP and similar laws to kind of pick up where the CFPB is leaving off. And what New York has done here with the FAIR Business Practices Act does pick up on a lot of those recommendations from the CFPB report. So, I think it is no coincidence. And in fact, I think it is Attorney General James taking a cue from the outgoing CFPB and incorporating a lot of those suggestions.

Chris Allen (07:10)

Obviously, something we’ve talked about on a few of our podcasts so far has been AGs trying to anticipate the impacts of the federal rollback on regulatory agencies like the CFPB and others and what they can do to fill that gap. At the same time, as you pointed out, there are things that are specifically mentioned here in the New York AG press release, if not in legislation, like data privacy, like dark patterns, like  programs that are hard to cancel, that we’ve heard specifically mentioned by AGs at consumer protection conferences and also in complaints and CIDs as alleged specific instances of companies engaging in what they perceived to be violations of the consumer protection law. So really what you have here, I think the intent of General James’s office is to both marry those two things together so that they can both expand the law to cover the CFPB regulatory gap, but also to address these kind of newer forms or more cutting-edge forms of alleged consumer protection violations. Do you think that’s a fair statement of what they’re trying to do here?

Emily Yu (08:20)

I think so. I I think that New York has always been a leader in the consumer protection front. And I think even before these proposed amendments, New York had been leading on addressing up-and-coming consumer protection issues, like AI-based, potentially deceptive or abusive acts and things like junk fees and subscriptions that are hard to handle. And I think this is a situation where the AG is getting involved to update legislation to catch up to the work it has already been doing in their office. I know, Chris, you and I had previously spoken about the roles of AGs, not just as enforcers of consumer protection law, but also being active in the legislative arena. And I think this is a great example of the New York AG getting involved here.

Looks like this legislation was actually sponsored by a state senator and assembly member. This goes to show that even when the AG’s name is not even on the piece of legislation that they can have a big impact in shaping that legislation.

Chris Allen (09:33)

No, that’s exactly right. I mean, we’ve seen in California, the CCPA, when that was enacted, well, it was when it was proposed rather, the attorney general’s office there in California both had a significant role in drafting the legislation. And then also in promulgating the implementing regulations that basically are the day-to-day way that that statutory scheme, which is, don’t think anybody disputes this, the most comprehensive data privacy regime in the country, how that’s executed, that was entirely due to the California attorney general. I know that when, I recall when Colorado AG Phil Weiser took office, one of the very first priorities of his office was updating their UDAP statute in the same way that General James is proposing here. Maybe not quite as broadly, but expanding in the jurisdiction of the AG’s office, providing additional definitions of prohibited conduct, most notably expanding what is, who can bring suit and what kind of penalties they could seek. And it’s not just limited to Democrat states. I mean, Texas with the Texas Data Security and Privacy Act that Hannah and I talked about last time, the AG’s office had a significant role in that too. And so, yeah, I think that’s a really good point that it’s not just AGs’ interest in these laws as enforcers of the laws or regulators, it’s also as policymakers and legislators almost in their own right. Maybe not quite. General James’ name is not on the law, but like, the fingerprints of her office are all over it.

Emily Yu (11:03)

We kind of covered the main points of the FAIR Business Practices Act earlier, but there are some additional points that you just reminded me of in what you mentioned about the other states’ laws that I also wanted to bring up because I think they are pretty notable. There are some other provisions that are not in all other states’ UDAP laws that are in maybe half or a handful or a dozen or so of other states’ laws. And just to run through them really quickly, some of the notable ones include the fact that the loss of privacy is now an actionable injury under the amendments proposed here. The proposed amendments also eliminate the need to establish financial loss. It enhances penalties for categories of vulnerable persons such as youth, seniors, service members, veterans, and it increases penalty amounts. It doesn’t bring New York’s penalty amounts to the top amounts among other states’ UDAP laws, but it significantly increases the penalty amounts there. And one other provision that’s proposed in the amendment to the UDAP law is it incorporates an explicit right to file class actions, which is not something that is in most other states’ UDAP laws.

Chris Allen (12:27)

The talk about creating a specific statutory right for a loss of privacy as an actionable injury and eliminating the need to establish financial loss; those go directly towards recent U.S. Supreme Court precedent. I’m thinking of the TransUnion case, and I know there’s a line of cases that precede that where the Supreme Court has been wrestling, especially in the context of data breaches and data privacy, with what constitutes an injury, in fact, that can establish Article 3 standing. And obviously, Congress can establish standing at the federal level through statute. And what I think you’re seeing in this act is an attempt by the New York legislature to do the exact same thing and to remedy something that’s really been an area of hot dispute, especially when it comes to states that are attempting to exercise their parens patriae authority under their UDAPs or under their data privacy or data breach laws, if they have them,  to enforce and make sure that consumers are being safeguarded.

And you don’t have to show harm, like financial harm, but you do have to show some kind of injury. And so, what the New York legislature is doing here is kind of plugging a hole and saying, no, for the purposes of our consumer protection law, this is what injury means. And the potential, at least in New York, for that to expand to all kinds of different harm other than somebody actually having their credit card stolen and used by Russian hackers to buy missiles to shoot Ukrainians with.  I made that up. I don’t know if that’s actually happening, but I wouldn’t be surprised. It’s expanding the AG’s authority in ways that you can kind of forecast but also given the creativity AGs have shown in exercising their consumer authority, really may not have, I think, a limiting principle in terms of where they can take this from here.

Emily Yu (14:17)

I agree that these proposed amendments mirror in a lot of ways the priorities that AGs are already focused on, such as data privacy, data breaches. I think the enhanced penalties for vulnerable persons that specifically covers binding violations that affect youth, we can kind of forecast out what we think those penalties might be applied to in the future with AGs having this continued interest in protecting youth in social media or against vapes or tobacco products like we talked about on our last podcast together. I think there’s a lot of clues in what’s written into these amendments to New York’s UDAP law that both point to what the AG is focused on now, but also we can forecast out to see in the probably very near future, how these new amendments might play out in continued areas of AG interest.

Chris Allen (15:18)

Yeah, it’s almost the newspaper headlines, right? It’s the what, the how, the who. What are you doing in terms of your business conduct? How are you doing it in terms of: Are you using dark patterns? Are you not safeguarding data? Are you trading data without notifying consumers? And who are you doing it to? Is it just everybody or are you targeting specific vulnerable populations like youth or seniors or service members?  And in all three of those things, what they have in common is, by expanding the range of those definitions, you necessarily expand the power of the attorney general. And of course, we’re talking about New York here, but this is not certainly, as I alluded to earlier, the only expansion of consumer protection authority that you’ve seen throughout the country. I think it matters, like you said, with New York because they’ve traditionally been a leader in consumer protection. They’re a big state with a big, very sophisticated office. You have a lot of businesses that are also headquartered there. Although I will note one thing I don’t think we’ve talked about that much is the idea that out-of-state conduct would be covered explicitly under the New York Consumer Protection Act now to include actions against anybody doing business with New York or New York consumers or businesses, regardless of the actor’s physical location. And I think that’s something that most states assert, but this New York law would make that explicit.

So, where I’m going with all of this is, is there something to… we’re using this as an example really of how AGs are continuing to evolve their consumer protection authority in ways that allow them to address the challenges that they perceive to be on the horizon. And whereas we’ve talked in numerous other podcasts about how AGs are very good at using their, existing authority in very novel ways to create novel causes of action or novel theories of relief, as I’ve talked about before many times, the modern data privacy statute is built out of AG UDAP actions that were later codified by statute.

Emily Yu (17:23)

One thing I wanted to add onto that, Chris, is I’m sure the New York Attorney General’s office has long had frustrations with how their current UDAP law is read, especially with the fact that it does not currently prohibit unfair acts and practices. But it’s also hard to not notice the timing of when these amendments are being proposed shortly after the CFPB’s report and, you know, with now the Trump administration and office I think you’ll see a lot of democratic AGs maybe looking back to see what more can we do with our existing consumer protection authority to fill perceived gaps or perceived future rollbacks of enforcement. I also remember seeing that California AG Rob Bonta had been working on some amendments to California’s antitrust laws. I think most notably, those amendments increase civil and criminal penalties. And that also came up within the last few months. So, I think you’ll see states who were traditionally more progressive, more Democratic leaders in areas like consumer protection stepping up, maybe revisiting existing legislation to beef up their statutory authority to step in and take action where they think they may need to or want to, given how their federal counterparts might be acting in the next few years.

Chris Allen (19:02)

That’s a fantastic point. I’m glad you raised that. There was a meeting just very recently of the Democratic Attorney Generals Association that I happened to be at. And one of the panels discussed the need, and it was an interesting panel because it wasn’t just AGs, you had some fairly senior corporate people on that panel too. And what they all agreed upon was the need and in fact the essentiality of certainty and stability in the regulatory environment if businesses are going to serve their customers, but also for AGs so that businesses can know what they view as appropriate conduct and not. And so if you have a world where the federal government is reining back on its consumer protection activities, or in the case of CFPB, possibly curtailing them altogether, AGs going to the legislatures and asking them to codify certain things and give them specific powers so that that’s a written statutory provision is very much fitting within that theme because you can go and you can read these laws now as a business and say, okay, this is what’s prohibited. This is what’s not. This is what the AG can do. And it gives you in a sense, a better understanding of what kind of priorities the AG has and what they can do vis-a-vis your business. If you listen to that, if you’re open to that, if you’re engaged with that and look for these instances of AG thinking, I think that’s one of the best prophylactics a business can have in protecting itself against adverse AG action. They’re not trying to hide the ball in this case. They’re telling you what they’re concerned about. They’re showing you how concerned they are. And all you have to do, well, I say all you have to do, it would behoove you to listen and to react accordingly.

Emily Yu (20:50)

That’s a great point, Chris. I think one of the other main takeaways from the act is there’s truly nothing groundbreaking in the way the amendments are written or even in the concepts that are inserted into the act. Prior to these amendments being proposed, it was simply left up to the courts to determine and to interpret New York UDAP law and its applications. And I think this also ties back, Chris, to your point about ensuring some kind of certainty for the future because things may not be so certain with how the federal government is running. The New York AG’s office is making sure that there is more that is set in stone and written out in the UDAP law and no longer leaving it up to New York or federal courts in New York to interpret these gaps in New York’s UDAP law. So I think this is another positive development in a way for businesses to have more certainty in what they can or what they can’t do in New York.

Chris Allen (21:52)

Yeah, I mean, that’s the silver lining way to look at it. I would I think General James’s office would also agree with that.  But it is an expansion of consumer protection authority.  And, you know, you don’t ask for authority without intending to use it. So, you know, I think the takeaways from here are:  the AGs are very much paying attention to what’s happening in the regulatory environment, especially with the changes that are being  done by the Trump administration in terms of the federal agencies. They were listening when those agencies  told them what they need to be doing in the event that there’s a gap that needs to be filled. They’re doing that not just by going to the courts and asking the courts to accept a legal theory but going to the legislatures and asking them to codify that.

And in so doing, however, they are not being shy about what they’re concerned about and what kind of things they’re looking at. And so if you want to keep out of an AG’s crosshairs, their expanding crosshairs, you really need to be paying attention to those things. If you have a question about a business practice or you see something like this and you think that you might be, you might be doing something the AG’s office is specifically targeting, there are ways to engage. There are ways to ask staffers. You don’t have to go bother Tish James herself,  but you know, there are ways of getting in there explaining your company, explaining your motivations and your products and making sure that everybody is on the same page because at the end of the day, I think businesses want to serve their consumers, the AGs want to protect their consumers, and there is a world in which those things are not mutually exclusive.

Well, Emily, as always, I have loved this conversation with you. think this was a fantastic development and fantastic story. So, I appreciate you bringing it to my attention. And as always, I really appreciated your insights. I learned a lot here. So, looking forward to the next time we have you on the podcast.

Emily Yu (23:52)

Thanks Chris for having me on and I look forward to joining again.

Chris Allen (23:56)

And everybody else, thank you again so much for joining us. We hope this was educational or productive or at least entertaining. We look forward to the next time you join us on State AG Pulse. In the meantime, stay safe and take care.

You have been listening to State AG Pulse brought to you by Cozen O’Connor’s State AG Group and the State AG Report. Please leave us a five-star rating and of course tune in again in two weeks for our next episode. Thank you so much for joining us.