Consumer Protection

In Depth

Clients turn to our consumer protection team when the stakes extend beyond the legal issue itself – when an investigation, civil investigative demand or complaint threatens product strategy, growth, brand trust, board attention or enterprise value. We advocate before regulators and defend investigations, enforcement actions, class actions and mass arbitrations with a clear eye on both outcome and optics.

Our roster of consumer protection and FTC lawyers includes many former high-level government officials, including:

• Staff attorneys
• Deputy assistant director for policy at the FTC
• Assistant director of the FTC Bureau of Competition and former assistant director of the UK CMA
• Senior advisor to former California Attorney General and former Vice President Kamala Harris
• Department of Commerce and European Commission-appointed arbitrator for the EU-US Privacy Shield Framework
• Chief of the Federal Communications Commission’s Enforcement Bureau
• Acting associate attorney general of the US
• Leading attorney from Robert Mueller’s special counsel investigation
• Assistant US attorneys with prosecution and trial experience across the US

That experience informs how we guide clients through investigations – drawing from firsthand knowledge of and deep insights into government enforcement agencies, including what regulators focus on, how they assess risk and where matters are most likely to turn.

We counsel public and private companies through every phase of a consumer protection matter, from the first access letter or consumer complaint through negotiated resolution, litigation or, in many cases, closure without action. Our team has handled matters before every state attorney general in the country and has deep experience with the FTC, the CFPB and the UK CMA.

Our breadth matters because today’s consumer protection issues rarely stay contained. A data sharing investigation can quickly turn into a Children’s Online Privacy Protection Act (COPPA) matter, a state AG inquiry, a putative class action and a reputational event all at once. A privacy or security issue can quickly expand into questions about disclosures, product architecture, children’s privacy, subscription and the Restore Online Shoppers’ Confidence Act’s (ROSCA) compliance practices or billing flows. Cooley helps clients navigate that convergence early and strategically.

Cooley helps clients prevent problems before they start. We partner with product, growth, engineering, marketing, privacy and commercial teams to evaluate sensitive aspects of our clients’ business operations, such as automatic renewal and cancellation flows, checkout and disclosure design, AI-enabled features, children’s and teens’ experiences, claims substantiation, endorsements and testimonials, adtech and cookie or tracking practices, and other operations that may attract regulator and plaintiff scrutiny. Our counseling is informed by how the FTC and state AGs actually investigate – what they ask for, what they focus on and which product or disclosure decisions tend to become the centerpiece of an enforcement theory or complaint.

We also have deep experience in helping clients navigate the compliance landscape before litigation or enforcement is underway. With our extensive knowledge of the relevant regimes and rapidly developing law, we are well-versed in applying those requirements to our clients’ business models, helping clients assess compliance gaps and develop strategies to enhance compliance.

Where a client has already agreed to a consent order, we provide practical advice regarding compliance and leverage our relationships with regulators to ensure that ongoing obligations are satisfied with minimal impact on company operations.

Cooley has represented clients in sprawling multistate investigations and achieved highly positive outcomes in high-stakes FTC and CFPB matters. We have advised household-name companies in more than 75 privacy class actions in recent years, including landmark matters involving data incidents, mass arbitrations, session-replay and wiretap theories, biometric and tracking claims, and other suits at the intersection of consumer protection, product design and data use. We know how to narrow claims early, position technical facts persuasively and negotiate from strength when settlement makes business sense.

Representative matters

• Representation of companies in FTC, state AG and other multijurisdictional investigations concerning privacy notices, data collection and sharing, children’s privacy (e.g., COPPA), security incidents, and adtech or tracking practices, often resulting in closure, narrowed demands, nonpublic resolutions or materially improved settlement terms
• Representation of C-suite employees named in their individual capacities in FTC Section 5 investigations
• Representation of clients in multistate attorney general investigations and related litigation involving dozens of subpoenas and civil investigative demands, hundreds or thousands of requests, and highly coordinated responses across legal, technical, business and communications workstreams
• Defense of consumer protection class actions and mass arbitrations involving advertising practices, privacy, data incidents, adtech, cookies, session replay, wiretap (e.g., the Children’s Internet Protection Act), the Video Privacy Protection Act, biometric, and related state consumer protection claims
• Defense of companies in FTC and state AG investigations concerning automatic renewal, subscription, negative-option, electronic billing, cancellation and disclosure practices (e.g., ROSCA and the California Automatic Renewal Law)
• Representation of financial services, fintech and payments companies in CFPB, FTC and state AG investigations concerning advertising, onboarding, disclosures, lending, servicing, billing and privacy practices
• Representation of a company in a UK CMA consumer protection investigation under the Digital Markets, Competition and Consumers Act 2024
• Advising multiple companies on consumer protection compliance strategies for advertising, subscriptions, product design and other consumer-facing commercial practices
• Counseling on product launches and go-to-market strategies for AI, connected devices and other cutting-edge technologies where consumer protection, privacy, trust and safety and reputational risk are inseparable
• Integrated representation with Cooley’s cyber/data/privacy, state attorneys general, AI and investigations teams on matters that demand a single coordinated response across agencies, jurisdictions and disciplines

Specific matters

• Secured exceptional results for a top education-technology company in several FTC matters concerning data security and automatically renewing subscriptions
• Represented a public cloud platform company in overlapping regulatory inquiries concerning data security, resulting in several being closed without further investigation.
• Defended a platform in a joint FTC and Washington state attorney general privacy and children’s privacy investigation
• Defended an education technology company in an investigation alleging violations of the COPPA
• Served as key outside counsel to a leading videoconferencing platform in a high-profile FTC matter, including a nonmonetary FTC settlement with no fine, no penalty, no user notice or refunds. Cooley also coordinated responses to parallel class actions.
• Handled one of the largest data-breach mass arbitrations in US history for an education-technology company, arranging a favorable resolution of more than 10,000 filed arbitrations and helping the company avoid tens of millions of dollars in nonrecoverable arbitration fees and significant additional exposure
• Litigated and secured a settlement with Washington, DC’s attorney general on behalf of a financial technology service provider concerning allegations that the company, which serviced loans in DC originating through a bank partnership, violated consumer protection laws and usury caps
• Represented a wireless telecommunications provider in an investigation and settlement with AGs from all 50 states and the CFPB concerning allegations of unauthorized billing practices