New INFORM Consumers Act Imposes Seller Diligence and Disclosure Requirements for Online Marketplaces

Client Alert  |  January 5, 2023

On December 29, 2022, the Integrity, Notification, and Fairness in Online Retail Marketplaces for Consumers Act (the “INFORM Consumers Act” or the “Act”) was signed into law as a last-minute addition to the Consolidated Appropriations Act of 2023, an omnibus bill that authorizes federal government spending for the upcoming year.[1]  The INFORM Consumers Act applies to online marketplaces – broadly defined to include “consumer-directed” platforms that “facilitate or enable third party sellers to engage in the sale, purchase, payment, storage shipping or delivery of a consumer product” – and requires them to collect, verify, and make available to buyers certain identification information for “high-volume third party sellers” on their platforms (i.e., sellers with more than 200 transactions and $5,000 in revenues in a 12 month period).  The Federal Trade Commission (“FTC”) is responsible for enforcing the INFORM Consumers Act, and state attorneys general are provided with the right to bring civil actions against online marketplaces whose noncompliance with the Act affects residents of their states.  Online marketplaces must implement policies, procedures, and controls to comply with the INFORM Consumers Act’s requirements by June 27, 2023, the date the requirements go into effect.

This alert summarizes the INFORM Consumers Act and discusses its new diligence and disclosure requirements, including the:

  • Collection of seller identification and bank account information within ten days of the seller qualifying as a “high-volume third party seller,” verification of the information within ten days of receipt, and collection of seller certifications regarding the accuracy of the information at least annually;
  • Maintenance of data security measures to protect seller information that the marketplace collects;
  • Disclosure to buyers of identification information for sellers with $20,000 or more in annual revenue from marketplace sales;
  • Suspension of seller accounts if requested information, certifications, or disclosures are not provided within ten days of a marketplace’s request; and
  • Implementation of a reporting feature on product listing pages for high-volume third party sellers that allows for electronic and telephonic reports.

While some online marketplaces may already comply with some of these requirements, it is likely that many will need to implement new measures to avoid the substantial liability risks that the Act creates for non-compliance.  In particular, requirements to collect and verify bank account and identification information and to obtain annual certifications – and to suspend sellers who fail to comply within 10 days – may present a significant operational lift for online marketplaces.  Covered marketplaces may also need to update their platform agreements, including, for instance, Merchant and Seller Terms of Service, Privacy Policies, Payment Processer Terms, and Purchaser Terms to reflect new requirements under the Act.  Moreover, the Act’s information collection and verification requirements may increase practical risks for online marketplaces by potentially exposing them to red flags of unlawful seller or buyer conduct that may give rise to liability in other contexts.

Gibson Dunn has extensive experience advising online marketplaces and commerce platforms on a wide variety of regulatory, product and commercial counseling, and enforcement matters.  We stand ready to advise companies on compliance with the INFORM Consumers Act.

I. Background on the INFORM Consumers Act

In March 2021, Senators Dick Durbin (D-IL) and Bill Cassidy (R-LA) introduced the INFORM Consumers Act as a bipartisan bill intended “to combat the online sale of stolen, counterfeit, and dangerous consumer products by ensuring transparency of high-volume third party-sellers in online retail marketplaces.”[2]  In recent years, similar bills were also introduced in many states, and several of them have passed into law.  Various online marketplaces and other companies initially opposed the Senate bill based on concerns that it would have a disproportionate impact on individual and small-business sellers.  In October 2021, Rep. Jan Schakowsky (D-IL) and Rep. Gus Bilirakis (R-FL) introduced a new version of the INFORM Consumers Act in the House.[3]  In announcing the bill, Rep. Bilirakis said it would “provide a layer of enhanced protections for consumers from stolen and counterfeit goods without adding undue burdens on small mom-and-pop businesses.”[4]  This version of the INFORM Consumers Act, which is nearly identical to the enacted version, received broader support than the Senate version.  Although the information collection and disclosure requirements generally remained the same, new supporters of the Act welcomed the House version’s decreased burden on individual and small business sellers and anticipated preemption of state laws.

On December 19, 2022, the INFORM Consumers Act was added to the Consolidated Appropriations Act of 2023, which passed Congress on December 23, 2022, and was signed into law by President Biden on December 29, 2022.

II. The INFORM Consumers Act’s Scope

The INFORM Consumers Act applies to “online marketplaces” where third parties sell “consumer products.”  “Online marketplaces” is broadly defined to include any “consumer-directed” platform that—(A) includes features that allow for, facilitate, or enable third party sellers to engage in the sale, purchase, payment, storage, shipping, or delivery of a consumer product in the United States; (B) is used by one or more third party sellers for such purposes; and (C) has a contractual or similar relationship with consumers governing their use of the platform to purchase consumer products.”[5]

Online marketplaces must comply with the Act’s information collection and verification, data security, and reporting requirements for “high-volume third party sellers” on their platforms; whereas, the Act’s disclosure requirements apply only to a subset of those sellers with higher annual revenues.  “High-volume third party sellers” is defined as “third party sellers [that] in any continuous 12-month period during the previous 24 months, ha[ve] entered into 200 or more discrete sales or transactions of new or unused consumer products and an aggregate total of $5,000 or more in gross revenues.”[6]  The Act’s disclosure requirements apply only to high-volume third party sellers that have at least $20,000 in annual gross revenue through the marketplace.[7]

The INFORM Consumers Act adopts, by reference, the Magnuson-Moss Warranty Act’s (“Mag-Moss”) definition of “consumer products,” which is “any tangible personal property which is distributed in commerce and which is normally used for personal, family, or household purposes (including any such property intended to be attached to or installed in any real property without regard to whether it is so attached or installed).”[8]  Notably, this definition has been interpreted as applying only to physical, retail goods, and as not including digital goods or other intangible items, services, or goods purchased for a commercial purpose.

III. The INFORM Consumers Act’s Requirements

The INFORM Consumers Act requires online marketplaces to: (i) collect and verify bank account and identification information for high-volume third party sellers and obtain periodic certifications from those sellers regarding the accuracy of the information; (ii) ensure the disclosure of certain seller information to buyers; (iii) provide clear and conspicuous reporting mechanisms on product listing pages for high-volume third party sellers; and (iv) comply with data privacy and security requirements for information received pursuant to the Act.  Marketplaces are further required to suspend sales activity for sellers that do not provide the required information, certifications, or disclosures within ten days.

These requirements go into effect 180 days after the Act’s enactment – i.e. by June 27, 2023.[9]

The following sections detail each of the Act’s requirements and highlight considerations for implementing measures to comply with those requirements.

a. Diligence Requirements: Collection, Certification, and Verification of High-Volume Third Party Seller Information

i. Information Collection

The INFORM Consumers Act requires an online marketplace to collect:

  • A seller’s name, email address, phone number, tax identification number, and banking account information within ten days of the seller meeting the transaction and revenue thresholds to qualify as a “high-volume third party seller.”[10]
  • For entity sellers, marketplaces must also obtain either a copy of a valid government-issued identification for an individual acting on the seller’s behalf or a copy of a government-issued record or tax document that includes the business name and physical address of the seller.

The Act provides that the required bank account information may be collected either by the marketplace itself or by a “payment processor or other third party contracted by the online marketplace to maintain such information, provided that the online marketplace ensures that it can obtain such information within 3 business days . . . .”[11]  If a seller does not have a bank account, the Act permits marketplaces to instead collect the “name of the payee for payments issued by the online marketplace to such seller.”[12]  Although the Act requires the collection of bank account information, it does not include language limiting permissible payment methods that an online marketplace may accept.

Importantly, if a seller does not provide the required information within ten days of qualifying as a high-volume third party seller, the marketplace must suspend sales activity by the seller until the information is received.[13]

Although not as arduous, these collection requirements are similar, in some respects, to customer due diligence and know-your-customer requirements imposed on financial institutions under the Bank Secrecy Act (“BSA”), the anti-money laundering regulatory regime applicable to financial services entities.  Lessons learned from that regulatory regime might be informative as to what online marketplaces can expect in implementing these requirements and what factors may be considered in assessing compliance with the requirements.  As seen in the context of the BSA, such information collection requirements can prove quite challenging to implement, particularly to a high volume of existing relationships.  In addition, as discussed below, information collected to comply with these requirements could, in certain cases, create heightened liability risk for marketplaces to the extent that the information raises red flags that the seller may be engaged in, or facilitating, unlawful activities.

Although many marketplaces already have information collection procedures for their sellers, it is likely that the Act’s specific requirements will require changes or additions to processes for nearly all marketplaces.  Many marketplaces that already collect seller information, for example, rely on third party payment processors or other third parties to gather and store at least some of that information.  Although the Act allows marketplaces to rely on third parties for the collection and storage of bank account information, there is not similar language for the records and other information that marketplaces need to collect, suggesting that marketplaces may be expected to collect and store that information themselves.  In addition, marketplaces that would like to rely on payment processors or other third parties for the collection and storage of bank account information should consider whether existing or new agreements have sufficient provisions regarding the collection and prompt accessibility of that data, as required by the Act.  Marketplaces may also need to consider implementing measures to identify efforts by sellers to evade the collection thresholds by seeking to establish multiple seller accounts on the marketplace.

The requirement to collect bank account information from sellers may also require a variety of new processes and controls.  Many marketplaces allow their sellers to receive payments to non-bank online accounts or wallets.  Some marketplaces may not collect information about those accounts and may simply allow sellers to link the accounts via APIs.  Marketplaces may now need to request, either themselves or through a third party, bank account information for high-volume sellers.  Although there is an exception for sellers that “do not have a bank account,” it remains to be seen what level of validation a marketplace would need to engage in to establish that a seller does not have a bank account in order to rely on this exception.

Marketplaces must also consider how and when they will collect the required information for new sellers, as well as how they will upgrade collection and verification for existing sellers.

ii. Seller Certifications

The Act also requires that platforms “periodically, but not less than annually,” notify high-volume third party sellers of their need to update information provided to the marketplace if there are any changes and obtain electronic certifications from those sellers that the information on file is accurate and up-to-date.[14]  If a seller does not provide a certification within ten days of a request for one, the marketplace must suspend the seller’s sales activity pending receipt of a certification.[15]  This requirement could create substantial disruption on marketplaces if seller accounts are frequently suspended and reactivated.

iii. Information Verification

The INFORM Consumers Act requires marketplaces to “verify” information collected from sellers within ten days of receipt.  The Act defines “verify” as “to confirm information provided to an online marketplace pursuant to [the Act], which may include the use of one or more methods that enable the online marketplace to reliably determine that any information and documents provided are valid, corresponding to the seller or an individual acting on the seller’s behalf, not misappropriated, and not falsified.”[16]  There is a presumption of verification for information contained in a “copy of a valid government-issued tax document.”  By providing a presumption of verification, the Act may encourage the collection of those records, even when not required by the Act.  However, the Act does not include a similar presumption of verification for information contained in “government-issued identification,” which is a separate term used within the Act.

In the context of the BSA, which has similar requirements, there are a wide variety of methods that financial institutions use to verify identities, including, among others, running the information through third party identification verification solutions, using taxpayer identification matching tools, requesting copies of supporting records from the other party, and/or searching publicly available information.  It is possible that factors used to assess adequate identification verification under the BSA could be considered to assess compliance with the INFORM Consumers Act.

Notably, the Act provides that marketplaces must obtain a “working phone number” and “working email address” for high-volume sellers, which suggests that marketplaces may also be expected to verify the functionality and accuracy of that information.

As discussed below, these verification requirements could increase practical risks for online marketplaces by potentially exposing them to red flags or knowledge that they will need to act on to avoid liability in other contexts.

b. Disclosure Requirements: Make High-Volume Third Party Seller Information Available to Consumers

Per the Act’s disclosure requirements, marketplaces must require that sellers with $20,000 or more in annual gross revenue provide “clear and conspicuous” information to consumers either on the seller’s product listing pages or in order confirmations and the consumer’s transaction history, including: (i) seller name; (ii) seller’s physical address; (iii) “contact information for the seller, to allow for the direct, unhindered communication with high-volume third party sellers by users of the online marketplace, including…a current working phone number; [] a current working email address; or [] other means of direct electronic messaging (which may be provided to such seller by the online marketplace)…”; and (iv) whether a different seller was used to supply the product purchased, and if so, upon purchaser request, all of the information in (i), (ii), and (iii) for that sub-seller.  Marketplaces must also collect this information from these sellers.  There are limited exceptions to the disclosure requirements where a seller certifies that it has only a personal address and/or phone number.  Marketplaces must suspend sales activity for sellers that do not comply with these disclosure requirements within ten days of receiving notification of the requirement from a marketplace.  As with the Act’s other collection requirements, marketplaces will need to consider when and how to gather necessary information and any needed authorizations from sellers and sub-sellers to share the required information.

c. Mandatory Seller Account Suspensions

As noted above, the Act requires that sellers provide requested information and certifications and disclose required information within ten days of receiving such requests from an online marketplace.  If a seller does not comply within ten days, the marketplace must suspend the seller’s account from any further sales activity pending the seller’s compliance.

d. Reporting Mechanism Requirement for High-Volume Third Party Sellers

Under the Act, marketplaces also must incorporate a “clear and conspicuous” reporting mechanism on each product listing page for a high-volume third party seller.[17]  The mechanism must provide for both electronic and telephonic reports to the marketplace about “suspicious marketplace activity.”  Notably, information acquired through submitted reports may further increase risks under the other laws and regulations, as discussed below.  In response to this requirement, marketplaces should consider whether they have adequate and sufficient processes and resources to investigate and disposition these reports.  Marketplaces may also want to consider whether to implement or enhance policies regarding voluntary notifications to law enforcement upon learning about particularly high-risk conduct on their platforms.

e. Data Privacy and Security Requirements

The Act prohibits marketplaces from using information gathered “solely” to comply with its provisions for any other purpose than compliance with the Act, unless required by law, and it requires marketplaces to implement security measures to protect collected information.[18]  As to the latter, the Act provides that marketplaces “shall implement and maintain reasonable security procedures and practices, including administrative, physical, and technical safeguards, appropriate to the nature of the data and the purposes for which the data will be used, to protect the data collected to comply with the requirements of this section from unauthorized use, disclosure, access, destruction, or modification.”  Violations of this provision can be enforced in the same manner as those for the collection and disclosure of seller information.  This requirement may require significant cybersecurity and data-privacy assessment and enhancement efforts for many marketplaces, particularly those that have not previously collected or stored tax identification numbers, bank account information, or copies of government-issued records.

IV. Enforcement of the INFORM Consumers Act

The INFORM Consumers Act treats violations of its provisions “as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)),” with the effect that violations will be subject to a statutory civil penalty of $46,517 per violation.[19]  Online marketplaces can expect that the government will seek to count each alleged failure to collect, verify, protect, or report required information as a violation of the Act, potentially giving rise to substantial civil penalty exposure.  Online marketplaces may also expect an increase in government investigations and potentially third party subpoenas for seller information as a result of the Act.

Because it is likely that the FTC will seek a civil penalty for most violations of the Act, the Act will add to the growing number of actions referred by the FTC to DOJ’s Consumer Protection Branch, which litigates civil penalty actions on behalf of the FTC.  The number of such actions has increased steadily over the last few years, especially following the Supreme Court’s decision in AMG Capital Management, LLC v. FTC.[20]  In addition to seeking civil penalties, the FTC may pursue injunctive relieve[21] and relief “to redress injury to consumers,” including the “rescission or reformation of contracts, the refund of money or return of property, the payment of damages, and public notification.”[22]

The FTC also has authorization to engage in certain types of rulemaking regarding the Act’s requirements.  In particular, the Act provides that “the [FTC] may promulgate regulations…with respect to the collection, verification, or disclosure of information under this [Act], provided that such regulations are limited to what is necessary to collect, verify, and disclose [required] information.”[23]

The INFORM Consumers Act further provides that any state attorney general may bring a civil action in district court against any marketplace where there is reason to believe the marketplace has violated or is violating any of the Act’s requirements and the violation affects one or more residents of that state.[24]  State civil actions may seek to enjoin further violations, enforce compliance with the Act, obtain civil penalties under the Act, obtain other remedies pursuant to state law, and obtain damages, restitution, or other compensation on behalf of the state’s residents.[25]  The FTC may intervene in any action brought by a state, and states may join an action filed by the FTC.[26]  Consequently, we may see more partnerships between the FTC and states seeking to enforce provisions of the Act.

While the INFORM Consumers Act preempts states from enacting or enforcing laws that “conflict[] with the requirements of [the Act],” it continues to allow states to enforce complementary laws, including those that may impose requirements in addition to the Act’s terms.  This may lead to a patchwork regulatory scheme.

V. Additional Enforcement Risks Created by the INFORM Consumers Act

In addition to imposing new compliance burdens and direct enforcement risks, the Act’s collection and verification requirements increase practical risks for online marketplaces by potentially exposing them to red flags or knowledge that they will need to act on to avoid liability in other contexts.

Marketplaces, for instance, could face criminal and civil liability under various consumer protection statutes if they are deemed to have knowingly sold or distributed unlawful drugs or other products based on information they learned about sellers through complying with the Act.  Indeed, regulators already are increasingly focused on online marketplaces for their alleged roles in the sale or distribution of products that are unlawful or used for unlawful purposes.  As FTC Chair Lina Khan recently explained, regulators are “looking upstream at the firms that are enabling and profiting from [unlawful] conduct.”[27]  Recent examples of this trend include agency warnings to, and litigation against, marketplaces for their alleged distribution of unlawful products.[28]  And the trend is largely driven by many of the same factors that motivated passage of the INFORM Consumers Act, including a proliferation of smaller, anonymized, and foreign sellers against whom enforcement actions often are impractical or ineffective.[29]

The Act also could increase marketplaces’ exposure under anti-money laundering statutes if they ignore red flags of transactions involving criminal activity identified through compliance with the Act’s verification requirements.  Generally, anti-money laundering statutes prohibit conducting, attempting to conduct, or otherwise facilitating a financial transaction with knowledge that the proceeds involved are the proceeds of “unlawful activity” if the government can prove that the proceeds were derived from a “specified unlawful activity.”[30]  “Unlawful activity” can be a violation of any federal, state, or foreign law that constitutes a felony; whereas, “specified unlawful activity” includes over 200 types of U.S. crimes and certain foreign crimes, including trafficking in counterfeit goods, sanctions offenses, fraud, and controlled substances offenses.  Courts have found that knowledge for purposes of establishing a money laundering offense can be based on willful blindness or conscious avoidance, which may arise where one turns a blind eye or deliberately avoids gaining positive knowledge when faced with a high likelihood of criminal activity, e.g., ignoring red flags.[31]  If online marketplaces obtain information that raises suspicions that a seller is engaged in criminal activity, there could, in certain circumstances, be increased risk of liability under the anti-money laundering criminal statutes, particularly when they do not conduct additional diligence to resolve those suspicions.

As a result, online marketplaces should thoughtfully approach the design and implementation of systems to comply with the Act’s requirements, including consideration of processes where potentially problematic information is learned about a seller.  Marketplaces should also consider sanctions screening for information received pursuant to the Act, and procedures for parsing false positive results from true matches – particularly given the policy goals leading to the Act.

___________________________

[1] Consolidated Appropriations Act of 2023, H.R. 2617, 117th Cong. Div. BB, Title III, § 301 (2022), https://www.govinfo.gov/content/pkg/BILLS-117hr2617enr/pdf/BILLS-117hr2617enr.pdf (“INFORM Consumers Act”).

[2] Press Release, Committee on the Judiciary, Durbin, Cassidy, Grassley, Hirono, Coons, Tillis Introduce Bill to Ensure Greater Transparency for Third-Party Sellers of Consumer Products Online (Mar. 23, 2021), https://www.judiciary.senate.gov/press/dem/releases/durbin-cassidy-grassley-hirono-coons-tillis-introduce-bill-to-ensure-greater-transparency-for-third-party-sellers-of-consumer-products-online; see also INFORM Consumers Act, S. 936, 117th Cong. (2021).

[3] INFORM Consumers Act, H.R. 5502, 117th Cong. (2021).

[4] Press Release, Congresswoman Jan Schakowsky, Schakowsky Introduces Bill To Protect Consumers Making Online Purchases, (Oct. 5, 2021), https://schakowsky.house.gov/media/press-releases/schakowsky-introduces-bill-protect-consumers-making-online-purchases.

[5] INFORM Consumers Act at (f)(4).

[6] Id. at (f)(3).

[7] The Act does not include a provision providing for automatic adjustments to these thresholds for inflation.

[8] 15 U.S.C. § 2301(1).

[9] INFORM Consumers Act at (f).

[10] Id. at (a).

[11][11] Id. at (a)(1)(A)(i)(II).

[12] Id. at (a)(1)(A)(i)(I).

[13] Id. at (a)(1)(A) and (a)(1)(C).

[14] Id. at (a)(1)(B).

[15] Id. at (a)(1)(C).

[16] Id. at (f)(7).

[17] Id. at (b)(3).

[18] Id. at (a)(3-4).

[19] Id. at (c)(1).

[20] 593 U.S. ___ (2021).

[21] See 15 U.S.C. § 53(b).

[22] 15 U.S.C. § 57b(b).

[23] INFORM Consumers Act at (c)(3).

[24] Id. at (d)(1).

[25] Id. at (h).

[26] Id. at (3).

[27] Oversight of the Enforcement of the Antitrust Laws, Hearing Before the Subcommittee on Antitrust, Competition Policy and Consumer Rights of the S. Comm. on the Judiciary, 117th Cong. (Sept. 20, 2022), https://content.mlex.com/Attachments/2022-12-20_O426MIOT4L28LWDK%2fP210100SenateAntitrustTestimony09202022+(1).pdf.

[28] See, e.g., FDA, Warning Letter – 631751 (Oct. 28, 2022), https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/amazoncom-inc-631751-10282022; FDA, Warning Letter – 631755 (Oct. 28, 2022), https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/walmart-inc-631755-10282022; Order on Motion to Dismiss and Motion for Summary Decision, In the Matter of Amazon, Inc., CPSC No. 21-2 (Jan. 19, 2022), https://www.cpsc.gov/s3fs-public/pdfs/recall/lawsuits/abc/027-Order-on-Motion-to-Dismiss-and-Motion-for-Summary-Judgement.pdf?VersionId=fgW05hge.c7FvPZZOijVWVapvJBQKudZ; Press Release, EPA, EPA Issues Order to eBay to Stop Selling 170 Unregistered, Misbranded Pesticides (June 17, 2021), https://www.epa.gov/newsreleases/epa-issues-order-ebay-stop-selling-170-unregistered-misbranded-pesticide.

[29] See, e.g., https://www.fda.gov/international-programs/global-perspective/fdas-top-cop-adapting-challenges-globalization-and-e-commerce.

[30] See 18 U.S.C. §§ 1956-57.

[31] See, e.g., U.S. v. Nektalov, 461 F.3d 309, 313-14 (2d Cir. 2006).

The following Gibson Dunn lawyers prepared this client alert: Ryan Bergsieker, Ashlie Beringer, Gustav Eyler, Svetlana Gans, Roscoe Jones, Alexander H. Southwell, Ella Alves Capone, and Amanda Neely.

Gibson Dunn has extensive experience advising online marketplaces on a wide variety of enforcement, regulatory, and compliance matters, and we stand ready to help guide industry players through complex challenges posed by increased regulation, enforcement focus, and technical innovation impacting the space. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s  Privacy, Cybersecurity and Data Innovation, Anti-Money Laundering, FinTech and Digital Assets, Public Policy, and Administrative Law and Regulatory teams, or any of the following:

Ryan T. Bergsieker – Denver (+1 303-298-5774, [email protected])
Ashlie Beringer – Palo Alto (+1 650-849-5327, [email protected])
Gustav W. Eyler – Washington, D.C. (+1 202-955-8610, [email protected])
Svetlana S. Gans – Washington, D.C. (+1 202-955-8657, [email protected])
Roscoe Jones, Jr. – Washington, D.C. (+1 202-887-3530, [email protected])
Alexander H. Southwell – New York (+1 212-351-3981, [email protected])
Ella Alves Capone – Washington, D.C. (+1 202-887-3511, [email protected])
Amanda H. Neely – Washington, D.C. (+1 202-777-9566, [email protected])

© 2023 Gibson, Dunn & Crutcher LLP

Attorney Advertising:  The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.