Friday, 1 May 2026

The Global Patent Chess Game Comes to Munich

OxFora’s 14th IP & Competition Forum to examine SEPs, injunctions, long-arm jurisdiction and international patent strategy

Munich, Germany — 23–24 June 2026 — As patent disputes increasingly cross borders, courts, competition authorities and patent offices are becoming central actors in the global governance of innovation. Questions once seen as technical — standard-essential patents, injunctions, FRAND, long-arm jurisdiction, global rate-setting, patent quality and cross-border enforcement — now shape market access, licensing dynamics and international technology strategy.

Against this backdrop, OxFora will convene the 14th IP & Competition Forum under the theme:

The Global Patent Chess Game: International Patent Strategy in a Fragmented World Order

The Forum will examine how international patent strategy is changing in a world where litigation in one jurisdiction can influence licensing negotiations, market entry and enforcement outcomes across many others. It will address the growing role of injunctions, the strategic use of parallel proceedings, the reach of national courts, the management of global FRAND disputes, and the interaction between patent enforcement, competition law and economics.

The programme will bring together senior judicial, regulatory, patent-office, industry and academic perspectives to discuss how legal systems are responding to these pressures and whether greater predictability is possible in international patent enforcement.

Key topics include:

SEPs — FRAND — Injunctions — Long-Arm Jurisdiction — Global Licensing — Streaming — Patent Quality — Competition Policy — International Patent Strategy

Keynote speakers and senior contributors include:

·         Prof. Meier-Beck — UPC Advisory Board; Presiding Judge, German Federal Court of Justice, ret.

·         Sir James Mellor — High Court of England & Wales

·         Dr Oliver Schoen — Regional Court of Bavaria

·         Dr Hubertus Schacht — Regional Court of Bavaria

·         Judge Fabian Hoffmann — Federal Court of Justice, Germany

·         Judge Victor Jaccoud Diz Torres — Judge, Rio de Janeiro, Brazil

·         Judge Juan He — Senior Judge, Intellectual Property Court, Supreme People’s Court of China

·         European Commission — DG Competition and Legal Service

·         UKIPO, DPMA, EPO & Bundeskartellamt (German Competition Authorities)

The Forum will also include perspectives from major technology, licensing and industrial stakeholders, including Nokia, BMW, Time Warner, Volkswagen, HP, Bosch BSH Haushaltsgeräte, Canon, Panasonic, Amazon and Philips.

The Forum is supported by leading sponsors including Hogan Lovells, Nokia, Thum & Partner, Freshfields, DLA Piper, Vossius, Huawei, Xiaomi, RPX and Access Advance.

“Patent enforcement has become a matter of international strategy,” said Dr Roya Ghafele, convenor of the Forum. “Injunctions, SEPs, long-arm jurisdiction and global licensing disputes are no longer isolated legal questions. They shape market access, competition and the global economic order.”

The 14th IP & Competition Forum will take place at the DPMA, the German Patent and Trade Mark Office, in Munich on 23–24 June 2026.

Get involved:
https://www.oxfora.org
info@oxfirst.com

Media contact:
OxFora
Email: info@oxfirst.com
Website:
https://www.oxfora.org/

 

Wednesday, 15 April 2026

U.S. Treasury Department Active in Addressing Cybersecurity Issues

The U.S. Treasury Department recently issued two press releases concerning cybersecurity.  First, the Treasury Department created a cybersecurity information sharing initiative for U.S. digital assert companies.  Second, the Treasury Department sanctioned actors who stole trade secrets involving cybersecurity tools from a U.S. company.  The Press Releases are below. 

Treasury Launches Cybersecurity Information Sharing Initiative for the Digital Asset Industry

WASHINGTON – Today, the U.S. Department of the Treasury’s Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) announced a new initiative to strengthen cybersecurity across the digital asset industry. The initiative will provide timely, actionable cybersecurity information to eligible U.S. digital asset firms and industry organizations, helping them better identify, prevent, and respond to cyber threats targeting their customers and networks. The effort advances a key recommendation from the President’s Working Group on Digital Asset Markets report, Strengthening American Leadership in Digital Financial Technology.

Treasury leadership highlights the growing importance of digital asset firms to the broader financial system.

“Digital asset firms are an increasingly important part of the U.S. financial sector, and their resilience is critical to the health of the broader system,” said Luke Pettit, Assistant Secretary for Financial Institutions. “By extending access to the same high-quality cybersecurity information used by traditional financial institutions, Treasury is helping promote a more secure and responsible digital asset ecosystem.”

Treasury also emphasized that cybersecurity is foundational to the future of digital finance and essential to responsible innovation.

“This initiative reflects the principles of the GENIUS Act by promoting responsible innovation grounded in strong cybersecurity and operational resilience,” said Tyler Williams, Counselor to the Secretary for Digital Assets. “As digital assets become more integrated into the financial system, access to timely and actionable cyber threat information is essential to protecting consumers and safeguarding the stability of U.S. financial markets.”

Treasury cybersecurity officials noted that the initiative responds directly to a rapidly evolving threat environment.

“Cyber threats targeting digital asset platforms are growing in frequency and sophistication,” said Cory Wilson, Deputy Assistant Secretary for Cybersecurity. “This initiative expands access to actionable threat information that helps firms strengthen defenses, reduce risk, and respond more effectively to incidents.”

Eligible U.S. digital asset firms and industry organizations that meet Treasury’s criteria will be able to receive, at no cost, the same actionable cybersecurity information Treasury regularly shares with traditional U.S. financial institutions. Interested firms are encouraged to contact OCCIP at OCCIP-Coord@treasury.gov for more information.

 

Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools

February 24, 2026

First-Ever Action Under the Protecting American Intellectual Property Act

WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated Sergey Sergeyevich Zelenyuk (Zelenyuk) and his company, Matrix LLC (doing business as Operation Zero), as well as five associated individuals and entities, for their acquisition and distribution of cyber tools harmful to U.S. national security.  Zelenyuk and Operation Zero trade in “exploits”—pieces of code or techniques that take advantage of vulnerabilities in a computer program to allow users to gain unauthorized access, steal information, or take control of an electronic device—and have offered rewards to anyone who will provide them with exploits for U.S.-built software.  Among the exploits that Operation Zero acquired were at least eight proprietary cyber tools, which were created for the exclusive use of the U.S. government and select allies and which were stolen from a U.S. company.  Operation Zero then sold those stolen tools to at least one unauthorized user.

“If you steal U.S. trade secrets, we will hold you accountable,” said Secretary of the Treasury Scott Bessent.  “Treasury will continue to work alongside the rest of the Trump Administration to protect sensitive American intellectual property and safeguard our national security.”

This action coincides with an investigation by the Department of Justice and the Federal Bureau of Investigation of Peter Williams, an Australian national and a former employee of the aforementioned U.S. company who pleaded guilty on October 29, 2025, to two counts of theft of trade secrets. 

Williams stole several proprietary cyber tools from the company between 2022 and 2025 and sold them to Operation Zero in exchange for millions of dollars paid in cryptocurrencies.

OFAC is designating Zelenyuk, Operation Zero, and the five associated individuals and entities pursuant to Executive Order (E.O.) 13694, as further amended by E.O. 14306 (“E.O. 13694, as further amended”).  In parallel with this action, the Department of State is sanctioning Zelenyuk, Operation Zero, and an affiliated UAE company, Special Technology Services LLC FZ (STS) pursuant to the Protecting American Intellectual Property Act (PAIPA).  These are the first persons sanctioned under this law, which provides for sanctions against persons who have knowingly engaged in, or benefitted from, significant theft of trade secrets of United States persons, if the theft of such trade secrets is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.  Please refer to the Department of State’s press release for more information about this action under PAIPA. 

ZELENYUK’S ACQUISITION AND SALE OF CYBER TOOLS

Russian national Zelenyuk,through his St. Petersburg, Russia-headquartered company Operation Zero, has been active as an exploit broker since 2021.  Operation Zero has offered millions of dollars in bounties to cybersecurity researchers and others for the development or acquisition of exploits targeting commonly used software, including U.S.-built operating systems and encrypted messaging applications.  Operation Zero does not disclose the discovered exploits to the companies developing the affected software, and Operation Zero customers could use the tools to launch ransomware attacks or engage in other malign activities.  In advertisements and other public-facing materials, Zelenyuk and Operation Zero have stated that they will only sell the exploits they acquire to customers from non-NATO countries.  Zelenyuk, through Operation Zero, has sought to sell exploits to foreign intelligence agencies.  Zelenyuk and Operation Zero have also sought to develop other cyber intelligence systems, including spyware and methods to extract personal identifying information and other sensitive data uploaded by users of artificial intelligence applications like large language models.  Operation Zero has sought to recruit hackers to support its activities and develop business relationships with foreign intelligence agencies through use of social media.

OFAC is designating Zelenyuk and Operation Zero pursuant to E.O. 13694, as further amended, for being responsible for or complicit in, or having engaged in, directly or indirectly, cyber-enabled activities originating from, or directed by persons located, in whole or substantial part, outside the United States that are reasonably likely to result in, or have materially contributed to, a threat to the national security, foreign policy, or economic health or financial stability of the United States, and that have the purpose of or involve causing a misappropriation of funds or economic resources, intellectual property, proprietary or business confidential information, personal identifiers, or financial information for commercial or competitive advantage or private financial gain.

. . .

The FTC, Competition, Political Viewpoint, Misinformation and Digital Advertising

The U.S. Federal Trade Commission has released a notice concerning an order agreed to by certain advertising agencies concerning digital advertising and anticompetitive conduct.  The court needs to approve the order.  The complaint is linked to below and is a fascinating read.  The Press Release states:

The Federal Trade Commission, along with a coalition of states, took decisive action today to stop collusion between the nation’s largest advertising agencies that distorted America’s modern public square.

Starting in 2018, major U.S. advertising agencies WPP, Publicis and Dentsu—who buy digital ad inventory on behalf of advertisers—unlawfully colluded to impose common “brand safety” standards across the digital advertising industry, according to the FTC’s complaint. The ad agencies, together with their primary competitors Omnicom and IPG, operated through trade associations to establish a common “Brand Safety Floor” to target “misinformation.”

The complaint alleges firms like NewsGuard and the Global Disinformation Index used this misinformation designation as a means to promote the demonetization of disfavored political viewpoints. In a competitive market, ad agencies compete for advertisers’ business by offering brand-safety tools that provide the best quality at the lowest cost. The brand safety agreement displaced competition by insulating the ad agencies from these competitive conditions, according to the complaint.

To resolve the FTC’s charges, the ad agencies have agreed to a proposed order that will stop the alleged coordinated conduct and prevent similar conduct from occurring in the future.

“The ad agencies’ brand-safety conspiracy turned competition in the market for ad-buying services on its head,” said Chairman Andrew N. Ferguson. “The antitrust laws guarantee participation in a market free from conduct, such as economic boycotts, that distort the fundamental competitive pressures that promote lower prices, higher quality products and increased innovation.

“As we explain in our complaint, the brand-safety agreement limited competition in the market for ad-buying services and deprived advertisers of the benefits of differentiated brand-safety standards that could be tailored to their unique advertising inventory,” he continued. “This unlawful collusion not only damaged our marketplace, but also distorted the marketplace of ideas by discriminating against speech and ideas that fell below the unlawfully agreed-upon floor. The proposed order remedies the dangers inherent to collusive practices and restores competition to the digital news ecosystem.”

As the complaint alleges, the ad agencies operated through their trade associations—specifically, the World Federation of Advertisers’ Global Alliance for Responsible Media (“GARM”) and the American Association of Advertising Agencies’ Advertiser Protection Bureau (“APB”)—to establish their common brand-safety standards. Under the agencies’ brand-safety agreement, websites that included so-called “misinformation” were deemed to fall below the brand safety floor and thus risked becoming categorically ineligible for advertising revenue.

If approved by a federal judge, the order will ensure that each of the biggest U.S. advertising agencies are prevented from engaging in agreements that would set common brand safety standards or restrict advertising based on biased and politically motivated criteria.

Omnicom and IPG are subject to a similar FTC order.

The Commission vote to issue the complaint and final order was 1-0-1, with Commissioner Meador recused. The FTC’s complaint and final order were filed in the U.S. District Court for the Northern District of Texas. Joining the complaint are Florida, Indiana, Iowa, Montana, Nebraska, Texas, Utah and West Virginia.

 

Friday, 10 April 2026

14th IP and Competition Forum. Munich, June 23 & 24 2026

 


Join us for the 14th IP & Competition Forum
Munich, June 23–24

🌐 https://www.oxfora.org
🌐 https://oxfirst.com/14th-intellectual-property-and-competition-forum/

📍 Venue: DPMA Forum, Deutsches Patent und Markenamt (German Patent Office)

With a strictly limited number of places, we are pleased to share a final overview of the level of participation already confirmed.

📩 Enquiries & registration: info@oxfirst.com


🔹 Senior Judiciary Confirmed

The forum will include judges and former judges from:

Landgericht Munich (including Presiding Judges)
Unified Patent Court (UPC)
High Court of England & Wales
Supreme Court of Germany
European Patent Office – Boards of Appeal (Chairs)
Supreme Court of China
Juiz de Direito, Rio de Janeiro
High Court of the Republic of Korea


🔹 Corporate IP Decision-Makers

Senior leadership attending includes:

Nokia · Amazon · Huawei · Philips · Panasonic · Canon · Cisco · Volkswagen · Audi · Deutsche Telekom · Xiaomi · 3M · Warner Bros Discovery · HP · Bosch · Harman · Vestel · Access Advance · Giesecke + Devrient

With participation from:

VP, Head of Global Litigation – Nokia
Senior Vice President & Associate General Counsel – Amazon
Head of IP Licensing (VP level) – Philips
Head of IP Litigation – Volkswagen
Head of Patents – Deutsche Telekom
Head of Licensing – Panasonic
Senior Director IP Policy & Litigation – Xiaomi
Associate General Counsel IP & Competition – Cisco
Vice President, Litigation – Warner Bros Discovery


🔹 Policy Makers

Senior officials participating include:

President – DPMA (German Patent Office)
Policy Officer – DG Competition, European Commission
Director & Chair – Bundeskartellamt, German Competition Authorities
Head of Standard Essential Patents, IP & Competition Policy – UKIPO
Head of European Affairs – UKIPO
Head of International Affairs – UKIPO
Head – Japan SEP Working Group
Head – Korea SEP Working Group
Legal Officer – Legal Services, European Commission


🔹 A Different Kind of Forum

This is a closed, highly curated gathering of:

• Judges shaping IP enforcement
• Senior executives responsible for global IP strategy and litigation
• Policy makers working towards effective governance

The format is designed for direct, peer-level exchange.


🔹 Limited Availability

Due to the format, participation is strictly limited.
We expect remaining places to be allocated shortly.

👉 Secure your place now: info@oxfirst.com


We would be delighted to welcome you in Munich.

Tuesday, 31 March 2026

White House Framework for AI Regulation to Set the Stage for Congress

President Trump has released a framework for AI regulation for Congress.  The Press Release states:

The Trump Administration is committed to winning the AI race to usher in a new era of human flourishing, economic competitiveness, and national security for the American people. Achieving these goals requires a commonsense national policy framework that both enables American industry to innovate and thrive and ensures that all Americans benefit from this technological revolution.

The Administration recognizes that some Americans feel uncertain about how this transformative technology will affect issues they care about, like their children’s wellbeing or their monthly electricity bill. These issues, along with other emerging AI policy considerations, require strong Federal leadership to ensure the public’s trust in how AI is developed and used in their daily lives.

Today, the Trump Administration is demonstrating that leadership by issuing a comprehensive national legislative framework  that addresses the most pressing policy topics that AI presents. This framework addresses six key objectives:

  1. Protecting Children and Empowering Parents: Parents are best equipped to manage their children’s digital environment and upbringing. The Administration is calling on Congress to give parents tools to effectively do that, such as account controls to protect their children’s privacy and manage their device use. The Administration also believes that AI platforms likely to be accessed by minors should implement features to reduce potential sexual exploitation of children or encouragement of self-harm.
  2. Safeguarding and Strengthening American Communities: AI development should strengthen American communities and small businesses through economic growth and energy dominance. The Administration believes that ratepayers should not foot the bill for data centers, and is calling on Congress to streamline permitting so that data centers can generate power on site, enhancing grid reliability. Congress should also augment Federal government ability to combat AI-enabled scams and address AI national security concerns.
  3. Respecting Intellectual Property Rights and Supporting Creators: The creative works and unique identities of American innovators, creators, and publishers must be respected in the age of AI. Yet, for AI to improve it must be able to make fair use of what it learns from the world it inhabits. The Administration is proposing an approach that achieves both of these objectives, enabling AI to thrive while ensuring Americans’ creativity continues propelling our country’s greatness.
  4. Preventing Censorship and Protecting Free Speech: The Federal government must defend free speech and First Amendment protections, while preventing AI systems from being used to silence or censor lawful political expression or dissent. AI cannot become a vehicle for government to dictate right and wrong-think. The Administration is proposing guardrails to ensure that AI can pursue truth and accuracy without limitation.
  5. Enabling Innovation and Ensuring American AI Dominance: The Administration is  calling on Congress to take steps to remove outdated or unnecessary barriers to innovation, accelerate the deployment of AI across industry sectors, and facilitate broad access to the testing environments needed to build and deploy world-class AI systems.
  6. Educating Americans and Developing an AI-Ready Workforce: The Administration wants American workers to participate in and reap the rewards of AI-driven growth, encouraging Congress to further workforce development and skills training programs, expanding opportunities across sectors and creating new jobs in an AI-powered economy.

Importantly, this framework can succeed only if it is applied uniformly across the United States. A patchwork of conflicting state laws would undermine American innovation and our ability to lead in the global AI race.

The Federal government is uniquely positioned to set a consistent national policy that enables us to win the AI race and deliver its benefits to the American people, while effectively addressing the policy challenges that accompany this transformative technology. The Administration looks forward to working with Congress in the coming months to turn this framework into legislation that the President can sign.

Monday, 30 March 2026

U.S. Government Accountability Office Report on AI Privacy Risks

The U.S. Government Accountability Office has released a report concerning privacy risks associated with utilizing AI in the federal government.  The privacy risks raised by experts include:

 

Risks Associated with Protecting Privacy When Using AI

The experts identified 10 key risks related to privacy when using AI, including potential invasions of privacy from data aggregation and the use of data for purposes exceeding what was originally intended. Table 1 identifies the 10 risks and associated descriptions.

Table 1: Expert-Identified Risks Associated with Protecting Privacy When Using Artificial Intelligence (AI)

Risk name

Associated risk description

Data persistence

Data may continue to exist in AI systems and be difficult to extract/remove once collected.

Data re-identification

AI has the ability to cross-reference multiple data sets from seemingly independent and anonymous outputs to reidentify anonymized data.a

Generation of deceptive or inaccurate outputs

AI may be used to intentionally or unintentionally generate deceptive outputs (e.g., deepfakes) or inaccurate outputs (e.g., hallucinations)b that may result in harm towards individuals.

Improper disclosure

AI can reveal and cause improper sharing of individuals’ data when it infers additional sensitive information from raw data.

Increased accessibility to sensitive information

AI can make sensitive information more accessible to a wider audience (e.g., data brokers) than intended.

Invasion of privacy from data aggregation

AI may combine various pieces of data about a person to make inferences beyond what is explicitly captured in those data (e.g., social scoring),c which can invade an individuals’ personal space and solitude by revealing private information (e.g., health-related, financial, location).

Lack of security over data

Inadequate AI data requirements and storage practices can result in data breaches and improper access.

Lack of transparency related to data use

AI may be used without providing individuals with notice and control over how their data is being used.

Lack of transparency in AI model algorithmic decision-making

The workings of AI models could include decisions based on individual data that one is unaware of and that can lead to privacy risks.

Secondary use of data

The use of personal data for purposes other than originally intended can be exacerbated by AI’s ability to repurpose data.

 

New US DOJ Corporate Enforcement Policy

The U.S. Department of Justice has released a Corporate Enforcement Policy concerning national security which allows U.S. corporations to voluntarily disclose violating white collar crime rules, including importantly, export control laws, and avoid prosecution (except in limited circumstances).  The Press Release states:

The mission of the Department of Justice’s National Security Division (NSD) is to protect and defend the United States against the full range of national security threats, consistent with the rule of law. Business organizations and their employees are at the forefront of protecting the national security of the United States by preventing the unlawful export of sensitive commodities, technologies, and services, as well as unlawful transactions with sanctioned countries and designated individuals and entities. Enforcing our export control and sanctions laws, and holding accountable those who violate them, is a top priority for NSD.

On March 10, 2026, the Department released its first-ever Department-wide corporate enforcement policy (CEP) for criminal matters, promoting uniformity, predictability, and fairness in how it pursues white-collar cases to protect the American people.

As the announcement explains, the “Department-wide CEP provides concrete benefits to incentivize companies to voluntarily disclose discovered misconduct, cooperate with our investigations, and timely and appropriately remediate the wrongdoing. For companies that do, absent certain limited aggravating circumstances, the Department will decline to prosecute the company. Incentivizing corporate self-disclosures — while still permitting prosecutions in appropriate circumstances — allows the Department to quickly pursue culpable individuals, secure justice for victims, and deter white-collar crime, all while not unduly burdening American businesses.”

Under the CEP, “disclosure must be made to the appropriate component of the Department,” CEP n.5, and all resolutions under the CEP “must be approved by the Assistant Attorney General (AAG) for the relevant Division.” CEP Background ¶ 4. The CEP also provides that a “[g]ood faith disclosure to one component where the matter is later brought to another appropriate component for investigation will also qualify” for declination. CEP n.5

As pertaining to national security laws, the Justice Manual (JM) assigns the “enforcement of all criminal laws affecting, involving or relating to the national security, and the responsibility for prosecuting criminal offenses, such as conspiracy, perjury and false statements, arising out of offenses related to national security . . . to the AAG of NSD.” JM § 9-90.010.

The scope of these matters, which includes violations of the U.S. government’s primary export control and sanctions regimes — the Arms Export Control Act (AECA), 22 U.S.C. § 2778, the Export Control Reform Act (ECRA), 50 U.S.C. § 4801 et seq., and the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq. – can be found at JM § 9-90.020.

While the conduct of business organizations and their employees has the greatest potential to implicate U.S. national security interests in the enforcement of export control and sanctions laws, the conduct of business organizations and their employees can also violate other U.S. national security laws, including laws prohibiting material support to and financing of foreign terrorist organizations, criminal violations in connection with the work of the Committee on Foreign Investment in the United States (CFIUS), and the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector (Team Telecom). Companies are encouraged to voluntarily self-disclose to NSD any potential criminal violations of U.S. law relating to matters conducted, handled, or supervised by the NSD AAG.

All voluntary self-disclosures concerning potential criminal violations of U.S. national security laws should be sent, with the company name in the subject line, to NSD’s email inbox for voluntary self‑disclosures: NSD.VSD@usdoj.gov.

Thursday, 19 February 2026

Regulating AI: A Thoughtful Approach?

Tom Wheeler at the Brookings Institution has published an excellent short paper titled, “Governing the AI Transition: Lessons from the 1996 Telecommunications Act.”  Mr. Wheeler states, in part:

The relevance of the Telecom Act of ’96 to the policy challenges of AI is not because AI is telecom, but because technological transitions produce bottlenecks that become the birthplace of durable private power. 

In 1996, Congress sought to legislate a transition by prioritizing competition. Now, in the AI era, we face an even more consequential transition. The stakes are not merely market structure or consumer pricing. The stakes extend to labor markets, intellectual property, national security, democracy, and the control of the tools of knowledge itself. 

The paper is available, here. 

Wednesday, 18 February 2026

US FTC Sends Letter to Data Brokers concerning Disclosing Sensitive Data to Foreign Adversaries

The Federal Trade Commission has sent a warning letter to Data Brokers about violating the Protecting Americans’ Data from Foreign Adversaries Act of 2024.  The FTC Press Release states, in part:

The Federal Trade Commission sent letters to 13 data brokers warning them of their responsibility to comply with the Protecting Americans’ Data from Foreign Adversaries Act of 2024 (PADFAA).

PADFAA prohibits data brokers from selling, releasing, disclosing, or providing access to personally identifiable sensitive data about Americans to any foreign adversary, which include North Korea, China, Russia, and Iran, or any entity controlled by those countries. The law defines personally identifiable sensitive data to include health, financial, genetic, biometric, geolocation, and sexual behavior information as well as account or device log-in credentials and government-issued identifiers such as Social Security, passport, or driver’s license numbers.

“The FTC is committed to enforcing PADFAA and ensuring companies are complying with its requirements,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “These letters should send a message to all data brokers to be aware of the law’s requirements and ensure they are not engaging in practices that violate it.”

The letters note that the agency has identified instances in which some of the letter’s recipients have “offered solutions and insights involving the status of an individual as a member of the Armed Forces. Such information is subject to PADFAA’s requirements.”

The letters warn the companies to conduct a comprehensive review of their business practices to ensure they comply with PADFAA, adding that a violation of the act may result in an enforcement action by the FTC, which could include civil penalties of up to $53,088 per violation.