In 2021, the U.S. Supreme Court held unanimously in AMG Capital Management, LLC v. Federal Trade Commission that the Federal Trade Commission is not entitled to consumer redress in cases brought under Section 13(b) of the FTC Act. This holding reversed decades of caselaw that had interpreted Section 13(b) broadly, stretching that provision's reference to the availability of injunctive relief to include measures considered related to an injunction, including returning money to injured consumers and requiring defendants to forfeit money they made from their scheme.

AMG represented a significant setback for the FTC, taking away a tool it used routinely in FTC Act cases. One of the FTC's responses to AMG has been to get creative in finding other ways to get the relief it wants in its enforcement actions. One of these creative workaround solutions is a new use of the Gramm-Leach-Bliley Act, outside of what the GLB provision was intended to address.

Since April 2024, the FTC has used the GLB provision in four cases: three against student loan debt relief schemes and one against a merchant cash advance provider. The GLB provision, 15 U.S.C. § 6821(a), prohibits "pretexting," which has long been understood to refer to the practice of making deceptive statements in order to obtain personal information to be used for identity theft. The FTC is now using this "pretexting" prohibition provision in enforcement actions alleging that defendants took payments from consumers without authorization. Unauthorized payments are likely to be involved in many FTC cases, so this development is important to understand.

Following AMG, companies may have thought that if the FTC alleged that a company improperly took payments from consumers in violation of the FTC Act's prohibition on unfair or deceptive acts and practices, the FTC could obtain an injunction stopping this conduct going forward. However, companies may also have reasoned that the FTC could no longer require a defendant to return consumers' payments. The FTC is using GLB to change that outcome.

Although the logic is deeply administrative, it does hold up. As the Supreme Court recognized in AMG, the FTC can seek consumer redress through Section 19 of the FTC Act, not Section 13. Section 19 applies to certain rules that the FTC enforces. GLB is not a rule, but it is enforced the same way as the Fair Debt Collection Practices Act. The FDCPA is not an FTC rule either, but its enforcement provision states that the FTC can enforce it as if it were a rule. Because the FDCPA can be enforced like a rule and because the GLB can be enforced like the FDCPA, the FTC can use Section 19, which relates to rules, to seek consumer redress under GLB.

With creative lawyering, the FTC has clawed back one of the enforcement powers that the Supreme Court took away in AMG. The four recent FTC enforcement actions using GLB in this new way—to go after allegations of unauthorized payments—tell us that we need to update our thinking about what the AMG decision means to the FTC's enforcement authority. Any company that satisfies the GLB's broad definition of a "financial institution" should expect the FTC to include a GLB cause of action in any case alleging that the use of unfair or deceptive conduct caused consumers economic harm. If the defendant is not a GLB "financial institution," depending on the facts, the FTC could also allege a violation of a rule covered by Section 19, like the Telemarketing Sales Rule, or another statute that can be enforced like a Section 19 rule, like the Restore Online Shoppers' Confidence Act, to seek consumer redress. AMG narrowed the FTC's ability to obtain consumer redress in certain cases. The FTC has found a creative way to push back on that result.