Advertising & Marketing

On July 10, 2026, New York City Mayor Zohran Mamdani and Department of Consumer and Worker Protection (“DCWP”) Commissioner Samuel Levine announced the adoption of a new “Click to Cancel” rule governing how businesses disclose, bill, and cancel subscriptions. The rule takes effect October 1, 2026.

Continue Reading New York City Adopts ‘Click to Cancel’ Rule

A federal court recently addressed whether plaintiffs alleging misleading commercial email practices in violation of Washington’s Commercial Electronic Mail Act (“CEMA”) have Article III standing to pursue claims. The ruling suggests that alleged violations of CEMA, standing alone, could constitute a concrete injury for Article III standing, where the asserted harm aligns with the statute’s purpose.

Continue Reading Washington Anti-Spam Law Decision Addresses Article III Standing in CEMA Cases

On April 17, 2026, the Italian data protection authority (the “Garante”) published Provision No. 284 setting out guidelines on the use of “tracking pixels” in emails (the “Guidelines”). This publication closely follows the recommendation issued by the French data protection authority on the same topic, which is discussed in a…

Continue Reading Italian DPA Publishes Guidelines on Email Tracking Pixels
On 29 April 2026, the UK Information Commissioner’s Office (“ICO”) updated its guidance on the use of storage and access technologies (i.e., cookies and other technologies that store or access information stored on users’ devices) under Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (“PECR”). These updates follow on the heels of two public consultations about the clarity of this guidance. We set out details of three of the most relevant updates for private companies below. Perhaps the most interesting element of the updated guidance, however, is an indication that the ICO is intending to follow through on its plan to enable the use of information storage / access technologies for “privacy-preserving” advertising purposes without consent. The ICO has not made explicit changes to its guidance, and the consultation response reiterates that the use of information storage / access technologies for online advertising—including related activities like frequency capping and ad measurement—currently requires consent under Regulation 6 of PECR. However, the ICO states that it will soon submit evidence to the UK Government on advertising-related activities that could be exempt from the PECR consent requirement, which the Government may then use to amend PECR to introduce statutory exemptions. It remains to be seen what the ICO will propose, but this could make it easier to engage in certain ad-related activities in the UK. … Continue Reading Three notable changes to the UK ICO’s guidance on cookies, and a hint of a more permissive approach to advertising cookies in the future

The Washington Supreme Court’s decision in Brown v. Old Navy LLC, 4 Wash.3d 580 (2025) has sparked a wave of putative class actions under Washington’s Commercial Electronic Mail Act (“CEMA”), targeting allegedly misleading email subject lines used by national retailers. In the months since, defendants have increasingly turned to constitutional and federal preemption defenses in an effort to stem this growing tide of litigation. To date, however, those arguments have gained little traction. Several district court decisions have denied defendants’ motions to dismiss on these grounds.

Continue Reading District Courts Appear Skeptical of CAN‑SPAM Preemption and Constitutional Challenges to CEMA

On December 11, 2025, the CNIL fined an Israeli company €1 million for failing to comply with its GDPR obligations after providing personalized advertising services to an EU music-streaming platform. The service helped the platform to personalize and optimize marketing campaigns to promote its streaming services.

The CNIL held that the GDPR applied to the non-EU processor under Article 3(2), on the basis that it had monitored the behavior of EU users by creating audience segments based on demographics and listening habits, on behalf of the controller.

Continue Reading French CNIL Imposes €1M GDPR Fine on Israeli Ad Tech Firm

A Washington State Supreme Court decision last spring that construed that state’s Commercial Electronic Mail Act (“CEMA”) to broadly prohibit any misleading information in retailers’ email subject lines has opened the floodgates to similar state spam claims. In the past six months, there have been eight putative class action complaints…

Continue Reading Recent Class Actions Under State Anti-Spam Laws Target Retail Email Marketing Practices and Raise Questions about CAN-SPAM Act Preemption

On August 7, 2025, the Federal Trade Commission (“FTC”) announced a $45 million settlement with online lead generator MediaAlpha, Inc. and its subsidiary QuoteLab, LLC (collectively, “MediaAlpha”), resolving allegations that the companies misled consumers seeking health insurance products. According to the FTC, MediaAlpha tricked consumers into sharing sensitive personal information under the guise of offering health insurance options through their lead generation sites. MediaAlpha allegedly then used that data for abusive telemarketing, including calling numbers on the National Do Not Call Registry. The FTC also alleged that MediaAlpha auctioned off consumers’ information to third-party lead generators and telemarketers, who similarly used that data to make illegal telemarketing calls.

Continue Reading FTC Takes Aim at Online Lead Generator

In July, the Federal Trade Commission (“FTC”) announced that telemedicine company NextMed agreed to pay $150,000 to settle charges that it deceptively advertised its GLP-1 weight-loss membership programs to consumers. The FTC’s complaint alleged a host of deceptive practices under Sections 5 and 12 of the FTC Act, including making unsubstantiated weight-loss claims, disseminating fake testimonials and consumer reviews, failing to adequately disclose the terms of its memberships, and purposefully making it difficult for consumers to cancel their memberships.

Continue Reading FTC Targets Weight-Loss Membership Program

With the Trump administration’s renewed focus on American manufacturing, FTC Chairman Andrew N. Ferguson’s recent declaration that July 2025 is “Made in the USA” Month appears to signal a renewed emphasis on Made in USA enforcement.  The FTC has a long history of scrutinizing these claims and the more recently-issued Made in USA Rule sets strict compliance standards with the threat of significant monetary penalties for non-compliance.  And while Chairman Ferguson’s statement nods to the importance of preventing deception in this area, it emphasizes that advertisers should be making Made in USA claims whenever they are appropriate.

Continue Reading FTC Declares July as “Made in the USA” Month