The Federal Trade Commission (“FTC”) recently announced a settlement with Apple, Inc. over allegations that the company billed parents and other account holders for children’s in-app activities without obtaining the account holders’ express and informed consent. The FTC’s complaint alleged that Apple’s failure to obtain express and informed consent prior to each in-app purchase constituted an unfair act or practice in violation of Section 5 of the FTC Act.

The FTC’s allegations stemmed from an App Store feature, disclosed in Apple’s Terms and Conditions, that allowed in-app purchases for up to fifteen minutes without requiring password re-entry after the user completed a password-requiring transaction. The FTC complaint alleged that this feature allowed children who were given possession of mobile devices after an initial password entry to incur charges for up to fifteen minutes without parental or accountholder knowledge.

This app feature would activate after in-app purchases were enabled and after either a password was entered to download an app, or a password was entered in making an in-app purchase. At least as late as 2011, entry of a password to download an app with in-app purchase capability began a fifteen minute window wherein in-app purchases could be made without reentering a password. According to a statement by Commissioner Ohlhausen, by March 2011, “consumers had submitted more than ten thousand complaints” regarding this practice. When this issue was brought to Apple’s attention, it addressed users’ concerns by implementing a password prompt for initial in-app purchases. However, Apple retained the fifteen minute purchase window feature where a password entry was made for an initial (or subsequent) in-app purchase. As Chairwoman Ramirez, Commissioner Brill, and Commissioner Ohlhausen note in their statements accompanying the settlement announcement, the unfair practice at issue was not the existence of the fifteen minute window itself, but Apple’s practice of not clearly disclosing the fifteen minute purchase window at the time of password entry, a practice that continued to be the subject of consumer complaints.

The FTC voted 3-1 to accept the consent agreement package, with Commissioner Wright voting against the package and issuing a dissenting statement. Chairwoman Ramirez and Commissioner Brill issued a joint statement. Commissioner Ohlhausen issued a separate statement “to emphasize that [the FTC’s] action [ ] is consistent with the fundamental principle that any commercial entity, before billing customers, has an obligation to notify such customers of what they may be charged for and when….”

Under the terms of the settlement, Apple must provide $32.5 million in full refunds to customers for unauthorized payments. If consumers claim less than $32.5 million in refunds, Apple must remit the balance to the FTC. Apple is also required to modify its in-app purchase procedures. Apple must obtain express informed consent for specific in-app charges by first notifying the consumer of “(1) the In-App Activity associated with the charge …; (2) the specific amount of the charge; and (3) the account that will be billed for the charge….” Apple may continue to provide its fifteen minute window feature by obtaining express informed consent for potential future in-app charges by notifying consumers of “(1) the scope of the charges for which consent is sought …; (2) the account that will be billed for the charge; and (3) method(s) through which the Account Holder can revoke or otherwise modify the scope of consent on the device….” Apple’s disclosures must be reasonably calculated to reach the account holders and notice and consent for potential future charges must be obtained at least once per device. The consent decree is set to terminate twenty years from its date of issuance. Apple must implement the settlement terms no later than March 31.

Apple CEO Tim Cook, in a January 15 announcement, stated that the settlement “does not require [Apple] to do anything [they] weren’t already going to do….” In the announcement, Cook acknowledged that Apple had “heard from some customers with children that it was too easy to make in-app purchases” and that, in reaction, Apple “created additional steps in the purchasing process.” In 2013, Apple undertook a campaign to refund any in-app purchase that “may have been made without a parent’s permission” by sending emails (or postcards) to customers who made in-app purchases in games designed for kids—28 million customers in total. Apple has received 37,000 claims, which it will reimburse, Cook said. According to the announcement, although “[a] federal judge agreed with [Apple’s] actions as a full settlement,” the FTC did not and, instead, initiated discussions with the company, which ultimately led to the January 15 settlement.

The FTC’s settlement package stretches the limits of its unfairness authority and may be interpreted to establish new disclosure standards. Even though Apple had immediately reacted to consumer complaints regarding its fifteen minute purchase window feature by altering its purchasing process and offering full refunds to affected consumers, the FTC pursued an administrative action based on its determination that Apple’s disclosure of the fifteen minute window in its Terms and Conditions and failure to disclose the fifteen minute window immediately prior to password entry constituted an unfair practice in violation of Section 5. In electing to pursue an administrative action where a company had already initiated a response, the FTC amplifies its unfairness authority and signals its belief that it may bring enforcement actions against companies that, in its own view, have not adequately responded to consumer complaints.

Commissioner Wright, in his dissent, takes issue with this expansion of authority. Wright criticizes the majority for “substitut[ing] its own judgment for a private firm’s decisions as to how to design its product to satisfy as many users as possible, and requir[ing] a company to revamp an otherwise indisputably legitimate business practice.” Wright also criticized the majority’s decision as premature given that Apple’s election to disclose the feature in its Terms and Conditions as opposed to disclosure alongside password entry “result[ed] in some injury to one group of consumers but [ ] generate[d] benefits for another group.” In this unique situation, where the challenged practice provides both benefits and injuries to varying groups of consumers, Wright believes the Commission should conduct a “robust analysis to determine whether the injury to the small group of consumers justifies the finding of unfairness….”

Wright also took issue with the Commission’s conclusion that the practice has caused substantial injury, noting that the estimated harm is “a miniscule fraction” of Apple iDevice sales and that, to qualify as substantial, the harm “must be large compared to any offsetting benefits.” Chairwoman Ramirez and Commissioner Brill dismissed Wright’s statement that the harm must be large when compared with offsetting benefits as “incorrect.” Their joint statement did not discuss the benefit to consumers of providing a streamlined and seamless user experience, which Apple had accomplished in part by not providing a disclosure regarding the fifteen minute window in the password prompt. Instead, the joint statement summarily concluded that the burden of adding the information would be “de minimis” and that “the required disclosure would not detract in any material way from a streamlined and seamless user experience.”

Wright also reminded the Commission that, according to the Commission’s Unfairness Statement, the injury suffered “must be one which consumers could not reasonably have avoided.” Here, Wright said, “it is very likely that most parents were able to reasonably avoid the potential for injury … [by] common sense and a modicum of diligence.”

Chairwoman Ramirez and Commissioner Brill rejected this position. Instead, they expressed their belief that the Terms and Conditions disclosure was not sufficient to provide consumers with adequate notice. And, because they found the disclosure in the Terms and Conditions did not provide adequate notice, the joint statement treated the disclosure as nonexistent—concluding that the fifteen minute purchase window was “not disclosed to [parents] and parents had no obligation to investigate the purchase policies after entering their password to allow a purchase.” (emphasis added). The joint statement went on to assert that, because parents had not been placed on notice, “it was reasonable for parents not to expect that when they input their iTunes password they were authorizing 15 minutes of unlimited purchases without the child having to ask the parent to input the password again.” (emphasis added). Therefore, according to Chairwoman Ramirez and Commissioner Brill, once the Commission determines that, in its belief, a terms of use disclosure does not provide consumers with adequate notice, it follows that it is reasonable that consumers are unaware of the terms and consumers have no obligation to investigate the contents of such terms. This logic, then, leads to the conclusion that consumers could not reasonably have avoided the harm.  

As described above and as highlighted by the sharp opposition of Commissioner Wright, the Commission’s settlement in this matter stretches the unfairness standard. Moreover, the notable settlement package promises to affect all players in the app market. The potential amplification of the unfairness standard to situations in which companies have made diligent efforts to alleviate consumer complaints that the  FTC nevertheless believes fall short increases the universe of activities potentially subject to enforcement action or FTC inquiry. Additionally, in its settlement package and accompanying statements, the Commission made clear the importance of obtaining informed, express consent and indicated that it will not hesitate to find lack of disclosure when it believes that a company’s practices do not provide meaningful consent.