FTC Enforcement

State of play.

• The FTC under Chair Ferguson is running parallel enforcement tracks: consumer-protection fundamentals (subscription fraud, health-data privacy, AI accuracy) and structural antitrust (Live Nation remedies, algorithmic pricing, DEI-as-collusion) are both active simultaneously (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices).
• The Hims & Hers complaint is the most significant new enforcement action — FTC plus California and Utah suing a major DTC telehealth brand over health-data sharing with Meta and Snap and ROSCA-violating subscription billing, following a nearly three-year investigation (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• State AG coalitions are now operating as an independent antitrust enforcement layer. Twelve state AGs have sued to block the $110 billion Paramount/Warner Bros. Discovery merger after DOJ cleared the deal — directly testing whether state coalitions can enjoin transactions that federal regulators approved (→ 12 State AGs Sue to Block $110B Paramount-Warner Bros. Discovery Merger, Twelve Blue States Sue to Block Paramount-Warner Bros. Discovery Merger After DOJ Clearance, 12 State AGs File Antitrust Lawsuit to Block $110B Paramount-Warner Bros. Merger).
• The Supreme Court's Trump v. Slaughter ruling has destabilized the EU-US Data Privacy Framework. The EDPB has requested a Commission reassessment; DPF transfers remain lawful for now but the adequacy decision's independence rationale is under formal challenge (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• For counsel advising telehealth companies, DTC subscription businesses, media transaction parties, or multinationals relying on the DPF, the practical baseline is that federal enforcement, state AG coalition action, and cross-border regulatory instability are all live simultaneously — no single clearance or compliance posture closes all vectors.

Where things stand.

• ROSCA/subscription enrollment standard is hardening through both enforcement and litigation. The Genesis Tech asset freeze remains the largest ROSCA action to date; the Hims & Hers complaint extends the theory to telehealth billing — charging before any provider consultation occurred; Judge Tigar's Uber ruling holds pre-stored credentials cannot substitute for fresh affirmative consent (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• Health-data sharing with ad platforms is now a primary FTC enforcement vector. The Hims & Hers complaint alleges disclosure of sensitive health information and customer lists to Meta and Snap through embedded tracking technologies — a theory that extends to any digital health company using pixel-based advertising infrastructure (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices).
• State AG coalitions are blocking transactions that federal regulators cleared. The 12-state coalition challenging the Paramount/Warner Bros. Discovery merger directly contradicts DOJ's June 2026 clearance and seeks a temporary restraining order against a September 30 close deadline — with a $650 million quarterly ticking fee at stake (→ 12 State AGs Sue to Block $110B Paramount-Warner Bros. Discovery Merger, Twelve Blue States Sue to Block Paramount-Warner Bros. Discovery Merger After DOJ Clearance, 12 State AGs File Antitrust Lawsuit to Block $110B Paramount-Warner Bros. Merger).
• FTC independence has been eliminated as a structural safeguard. Trump v. Slaughter permits at-will presidential removal of commissioners; the EDPB has formally requested that the European Commission reassess the DPF adequacy decision that relied on FTC independence as a data-subject protection (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• FTC is asserting federal preemption over state AI laws through a proposed AI accuracy policy statement. Chairman Ferguson's proposed statement frames AI output manipulation as a Section 5 violation and argues it preempts state AI regulations including Colorado's SB24-205; the federal-state AI preemption conflict is now a live compliance problem for AI companies operating across jurisdictions (→ FTC Seeks Public Comment on AI Policy Statement Curbing Ideological Manipulation).
• DEI coordination remains an active antitrust enforcement vector. The Diversity Lab closure following FTC warning letters to 42 law firms frames shared demographic hiring targets and competitor information-sharing as potential Sherman Act Section 1 violations — a theory the agency has signaled it will extend beyond the legal industry .
• Live Nation/Ticketmaster verdict has moved to the remedies phase. The 33-state coalition secured a jury finding of unlawful monopolization; DOJ settled mid-trial for $280M plus fee caps and divestiture of 13 amphitheater contracts; Judge Subramanian is overseeing structural remedies that could include forced Ticketmaster divestiture .
• Algorithmic pricing is under simultaneous federal and state scrutiny. The DOJ-RealPage settlement prohibits use of competitors' nonpublic data for price recommendations and imposes a court monitor; surveillance pricing investigations are expanding into retail, grocery, hotel, and hospitality .
• Data minimization and breach-notification obligations are binding consent-order terms for edtech. The Illuminate Education final order requires data deletion, a public retention schedule, and a comprehensive security program — imposing pre-breach data governance obligations that go beyond breach response .
• TAKE IT DOWN Act enforcement is live. Covered platforms must assign request IDs, notify users of removal decisions, and implement hashing tools for nonconsensual intimate imagery and AI-generated deepfakes; specific penalty thresholds remain partially opaque .
• HSR filing regime has reverted to pre-2025 requirements. The Fifth Circuit vacated the FTC's 2024 HSR overhaul; the size-of-transaction threshold is $133.9M under the prior lighter form .

Latest developments.

• FTC, California, and Utah sue Hims & Hers in N.D. Cal. alleging health-data sharing with Meta and Snap via embedded tracking technologies, pre-consultation prescription billing, and ROSCA-violating subscription cancellation practices — following a nearly three-year investigation (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, California, and Utah Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing)
• 12-state AG coalition files Clayton Act suit to block Paramount Skydance's $110 billion acquisition of Warner Bros. Discovery, directly contradicting DOJ's June 2026 clearance and seeking a TRO against a September 30 close deadline with a $650M quarterly ticking fee (→ 12 State AGs Sue to Block $110B Paramount-Warner Bros. Discovery Merger, Twelve Blue States Sue to Block Paramount-Warner Bros. Discovery Merger After DOJ Clearance, 12 State AGs File Antitrust Lawsuit to Block $110B Paramount-Warner Bros. Merger)
• EDPB formally requests European Commission reassessment of the EU-US Data Privacy Framework following Trump v. Slaughter; DPF transfers remain lawful but the adequacy decision's independence rationale is under active challenge (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal)
• FTC proposes AI accuracy policy statement under Chairman Ferguson asserting that AI output manipulation violates Section 5 and preempts state AI laws including Colorado's SB24-205; comment period closed July 31, 2026 (→ FTC Seeks Public Comment on AI Policy Statement Curbing Ideological Manipulation)
• Federal-state AI preemption conflict sharpens as FTC's proposed framework would not permit state AI law compliance as a defense to federal deception claims; the bipartisan Great American AI Act proposes a three-year freeze on new state AI development laws
• Blank Rome faces two class actions over a May 2026 social-engineering breach exposing 57,554 clients' data — including medical records and government ID numbers — with plaintiffs alleging FTC Act, HIPAA, and California consumer protection violations; one-month notification delay is a focal point (→ Blank Rome Sued Over May 2026 Data Breach Exposing 57K Clients' Data)

Active questions and open splits.

• Can state AG coalitions block transactions after federal clearance? The Paramount/Warner Bros. suit is the sharpest test yet — DOJ cleared the deal, but 12 states are seeking a TRO against a hard September 30 close deadline. Whether the court grants preliminary injunctive relief will define the operational risk of state coalition challenges for every large transaction going forward (→ 12 State AGs Sue to Block $110B Paramount-Warner Bros. Discovery Merger, Twelve Blue States Sue to Block Paramount-Warner Bros. Discovery Merger After DOJ Clearance, 12 State AGs File Antitrust Lawsuit to Block $110B Paramount-Warner Bros. Merger).
• Health-data pixel tracking as FTC Act and ROSCA violation. The Hims & Hers complaint alleges that embedding ad-platform tracking technologies on a health website — without adequate disclosure — constitutes deceptive practice. No court has yet ruled on this theory; the case will produce the first substantive judicial treatment of pixel-based health-data sharing as a federal consumer protection violation (→ FTC, Utah, and California Sue Hims & Hers Over Health Data and Billing Practices, FTC, Utah, and California Sue Hims & Hers Over Health Data Sharing).
• DPF adequacy after Trump v. Slaughter: formal reassessment or political resolution? The EDPB has requested Commission action, but no court has challenged the DPF's validity and transfers remain lawful. Whether the Commission initiates a formal adequacy review — and on what timeline — is unresolved; the answer determines whether thousands of companies need to activate SCCs or other fallback mechanisms (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• FTC AI accuracy preemption: does the proposed policy statement survive the Great American AI Act? The FTC's proposed framework asserts federal preemption of state AI laws; Congress is simultaneously considering a three-year freeze on new state AI development rules with an undefined consumer-protection carve-out. Whether the FTC's enforcement position survives, and how broadly the federal freeze applies, are both unsettled (→ FTC Seeks Public Comment on AI Policy Statement Curbing Ideological Manipulation).
• DEI coordination as antitrust collusion — how far does the theory travel? The Mansfield Certification theory has no appellate precedent; whether it survives challenge and whether the agency extends it to healthcare, finance, and tech DEI consortia remains the most consequential open structural question in the current enforcement cycle .
• ROSCA offshore-entity enforcement and individual liability. The Genesis Tech preliminary injunction froze assets held through shell companies; whether the order reaches offshore assets and whether individual liability attaches to the eight named defendants will define the practical limits of ROSCA enforcement against internationally structured operations .
• Structural remedies for Live Nation. Whether the state coalition pursues Ticketmaster divestiture or accepts behavioral remedies — and Judge Subramanian's response — defines the vertical-integration risk template for other concentrated industries .

What to watch.

• Preliminary injunction proceedings in the Paramount/Warner Bros. state AG suit — whether the court grants a TRO before the September 30 close deadline will immediately reshape the risk calculus for every large media and cross-sector transaction with pending federal clearance.
• European Commission response to the EDPB's DPF reassessment request — any formal adequacy review initiation triggers immediate contingency-planning obligations for DPF-reliant multinationals.
• FTC finalization of the AI accuracy policy statement following the July 31 comment period — the final text will clarify the preemption scope and enforcement mechanism against state AI laws.
• Hims & Hers early motions practice — whether the court sustains the pixel-tracking theory as a cognizable FTC Act violation will determine how broadly the health-data advertising enforcement theory travels to other digital health and DTC pharma companies.
• FTC enforcement actions against law firms that received Mansfield Certification warning letters — whether the agency pursues settlements with conduct restrictions or files complaints will clarify the operational scope of the DEI-as-collusion theory.
• Live Nation remedies phase — whether the state coalition moves for structural relief (Ticketmaster divestiture) or accepts behavioral remedies, and Judge Subramanian's response.