Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Section 5 of the Federal Trade Commission Act is one of the most important consumer-protection rules in American law. It is also one of the easiest statutes to misunderstand when it appears in a private demand letter. A recent Meta Pixel demand letter, and others sent to e-commerce and website operators, lists 15 U.S.C. § 45 as claim (b): the business supposedly engaged in an unfair or deceptive practice by installing the pixel and then used that practice as the “criminal or tortious” purpose needed to unlock the Electronic Communications Privacy Act. The citation sounds official. It does not give the claimant the lawsuit the numbering implies.
TL;DR
- The FTC Act prohibits unfair or deceptive acts or practices in commerce, including broken privacy promises, but Congress gave enforcement authority to the Federal Trade Commission, not to private plaintiffs seeking statutory damages.
- Demand letters still cite Section 5, usually as a predicate for the ECPA crime-tort exception or as an “unlawful” hook for California’s Unfair Competition Law.
- A privacy-policy mismatch or a banner that does not control tags can create real regulatory risk. That is not the same thing as a visitor having a private cause of action under the FTC Act itself.
What Section 5 actually does
15 U.S.C. § 45 declares unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce to be unlawful. Deception, in the Commission’s long-standing formulation, involves a representation, omission, or practice that is likely to mislead a consumer acting reasonably and that is material. Unfairness has its own statutory limits: the act or practice must cause or be likely to cause substantial injury that the consumer cannot reasonably avoid and that is not outweighed by benefits to consumers or competition.
Those standards have been used in privacy cases. The Commission has brought actions over privacy policies that did not match actual data practices, over defaults that were hard to refuse, and over design patterns that steered people toward sharing more than they realized. We have written about FTC attention to dark and deceptive patterns in consent banners. That history is why a pixel that fires before any choice, or a policy that never mentions Meta, can be more than a plaintiffs’-bar talking point. It can be a regulatory problem.
What Section 5 does not do is create a general private right of action for damages. The Ninth Circuit said so decades ago in Carlson v. Coca-Cola Co., 483 F.2d 279 (9th Cir. 1973), and courts have repeated the point since. A consumer who believes a business was unfair or deceptive may complain to the Commission. The consumer does not, by citing Section 5, step into the Commission’s shoes and demand $10,000 or $5,000 a violation.
How the statute appears in Meta Pixel letters
In the stacked ECPA letters we are seeing, the FTC Act is doing borrowed work. The letter alleges that installing the Meta Pixel, or failing to disclose it clearly, was unfair or deceptive. That allegation is then used in two ways. First, it is offered as the independent unlawful purpose that triggers the crime-tort exception in 18 U.S.C. § 2511(2)(d), so the business cannot rely on being a party to its own website communications. Second, it is sometimes folded into a California Unfair Competition Law theory, on the idea that an “unlawful” act can include a violation of another statute.
The factual story is usually the same one used for every other claim in the packet. A HAR file shows a request to Meta. An off-Facebook activity report shows a page-view event. The privacy policy, the letter says, did not describe that sharing, or the banner appeared too late to count. From those facts counsel infer a deceptive practice: the business presented a website as a two-party conversation while arranging a three-party transmission.
A related move is to pair Section 5 with federal wire-fraud citations. Both statutes are about deception. Neither is a private tracking statute. Stacking them makes the letter look like a federal enforcement file. It does not convert either provision into a consumer damages claim.
How strong is the theory?
As a standalone private cause of action, the FTC Act theory is weak. The no-private-right-of-action rule is not an obscure minority view. Recipients should not treat claim (b) as if a judge were about to award FTC-style penalties to the claimant.
As a crime-tort predicate, the theory has a different problem. The exception requires that the communication be intercepted “for the purpose of committing” a criminal or tortious act. Courts have required that purpose to be independent of the interception itself. Saying “we used a pixel, therefore we committed an unfair practice, therefore the pixel was for the purpose of an unfair practice” is circular. It is stronger if the plaintiff can point to a specific, material misrepresentation that the business allegedly made in order to obtain the data or a purchase, not merely to the existence of advertising technology.
Using Section 5 as an “unlawful” predicate under California’s UCL raises still another set of questions, including whether the plaintiff lost money or property and whether a federal statute reserved to an agency should be borrowed by a private party. Those issues belong in the UCL analysis. They do not disappear because the letter printed “15 U.S.C. § 45” in bold type.
None of this means sloppy disclosures are safe. The Commission can still investigate. State attorneys general can still use their own unfair-competition and deceptive-practice laws. A banner that visually prefers “accept” over “reject,” or a policy that promises not to share data while a pixel sends hashed emails, is the kind of mismatch regulators and courts both know how to read. The point is narrower: the statute the letter cites is not a private damages machine.
Practical steps if Section 5 appears in the stack
- Compare every privacy promise to the network log. If the policy says the business does not sell or share personal information, or names no advertising partners, and the Meta Pixel is sending events, fix the disclosure and the tag.
- Look at the banner the way an investigator would. Is reject as easy as accept? Does the pixel wait? Our notes on cookie consent best practices are a useful checklist here, not because the FTC Act requires a European-style banner in every U.S. state, but because a broken banner is what makes a deception story easy to tell.
- Turn off advanced matching and sensitive events until counsel has reviewed them. Sending hashed emails or product names that reveal a condition is harder to defend as a trivial, expected advertising practice.
- Keep the enforcement risk and the private-letter risk in separate folders. A Section 5 citation in a demand letter is usually there to support ECPA. A real FTC inquiry would look different and should be handled as a regulatory matter.
How Captain Compliance can reduce the facts that make the citation possible
The operational answer is the same one that helps with the rest of the stack. Captain Compliance’s consent management platform is built to show a region-appropriate banner, record the choice, and gate advertising pixels so they do not run in spite of that choice. The scanner tests pre-consent firing, rejection handling, and Global Privacy Control rather than assuming the banner text is enough. Accurate privacy-notice execution is part of the same system, and Compliance Shield can financially back qualifying claims connected to consent and disclosure when the platform is properly configured. Software does not give you a private FTC defense, because there is no private FTC claim to begin with. It does reduce the chance that your site will supply a neat deception narrative.
Frequently asked questions
Can a website visitor sue us directly under the FTC Act?
Generally, no. Section 5 is enforced by the Federal Trade Commission. Courts, including the Ninth Circuit in Carlson, have held that the statute does not create a private damages action. A letter that lists Section 5 as if it were CIPA is blurring that line.
If our privacy policy is accurate, does that end the FTC discussion?
An accurate policy is necessary, not always sufficient. A policy that describes sharing, paired with a banner that does not actually block the pixel, can still support an unfairness or deception story. The practice has to match the words.
Why cite a statute that the claimant cannot sue under?
Because the letter is trying to build an independent unlawful purpose for the ECPA crime-tort exception, and sometimes a borrowed “unlawful” act for California’s UCL. The citation can still be useful to the sender even if Section 5 itself provides no damages.
A federal enforcement statute is not a private invoice
The FTC Act belongs in a privacy program because regulators use it and because broken promises about tracking are exactly the sort of thing it reaches. It belongs in a demand-letter stack for a different reason: it sounds like federal liability and it gives the crime-tort exception another statute to name. Recipients should respect the first use and resist the second. Read Section 5 as a reminder to make the site tell the truth and behave accordingly, not as proof that a pixel automatically created a private federal claim.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
