Tech & Legal Updates
Short, executive level legal and commercial updates for founders and leaders of scaling technology businesses.
Data claims are enforceable business commitments
The Federal Trade Commission has reaffirmed that misleading privacy or security representations may breach Section 5 of the FTC Act. The Third Circuit in FTC v Wyndham Worldwide Corp, 799 F.3d 236 (3d Cir. 2015), held that unreasonable cybersecurity practices can amount to unfair conduct. Scaling technology companies should align product marketing, internal controls, and vendor governance to reduce regulatory and contractual exposure.
Marketing copy is a compliance surface
The practical consequence of treating representations as enforceable commitments is that the security page becomes part of the compliance perimeter. Statements written by marketing, sales decks assembled for a specific pitch, trust pages, and answers given in a security questionnaire all sit in the same category: they describe controls the business is then expected to actually operate.
The gap that creates exposure is rarely deliberate. It opens when a control is described accurately at the time and then quietly degrades, or when a claim is written aspirationally by someone who was not close enough to the implementation to know the difference.
What to check
- Whether the security claims on the public site match the controls currently in operation, not the ones intended at launch.
- Whether sales and marketing can make security representations without technical review.
- Whether completed security questionnaires are retained, so the business knows what it has already committed to and to whom.
- Whether encryption, retention and access control claims describe the current architecture or an earlier one.
Where this lands in the contract
The same principle flows down. A business that repeats a vendor’s security claims to its own customers has assumed the risk of those claims being inaccurate, usually without any corresponding warranty from the vendor. Where supplier representations are relied on in customer-facing material, they should be warranted in the supplier agreement rather than accepted from a datasheet.