Which statement about FTC enforcement actions for privacy protection is true?

• A. The FTC can impose fines
• B. The FTC can require annual audits by external firms for many years
• C. Both of the above
• D. Neither of the above

Answer: (C)

In privacy enforcement, the FTC uses consent orders that enforce privacy promises and deter violations through two practical tools: monetary penalties and ongoing oversight. The agency can impose civil penalties when a company breaches the terms of a settlement or engages in deceptive or unfair practices, making fines part of the enforcement toolkit. At the same time, many settlements require independent third-party audits or monitoring for years to verify that the company actually implements the promised privacy protections and to catch issues early. A well-known example is a major settlement that included a substantial monetary penalty along with long-term monitoring and reporting requirements. Taken together, these mechanisms show that both imposing fines and requiring ongoing external audits are legitimate, used elements of FTC privacy enforcement.