The Federal Trade Commission (FTC) resolved an enforcement matter against DoNotPay, Inc., issuing a binding Decision and Order (Docket C-4812) on January 14, 2025 [1]. This order requires DoNotPay to pay $193,000 to the Commission within 30 days of the order's effective date [1]. The company, while neither admitting nor denying the allegations, agreed to the terms, which include specific prohibitions on certain representations and a range of compliance and reporting obligations [1].
Monetary and Operational Compliance Deadlines
The order mandates a payment of $193,000 to the FTC [1]. This payment must be completed within 30 days of the order's effective date via electronic fund transfer [1]. Failure to meet this deadline will result in interest accrual and may lead to the entire amount becoming immediately due if default continues for 10 days beyond the due date [1]. Each day of nonpayment constitutes a separate violation [1].
Beyond the monetary relief, DoNotPay faces several immediate operational deadlines
- Order Acknowledgment — Within 10 days of the effective date, DoNotPay must submit a sworn acknowledgment of receipt of the order to the Commission [1].
- Order Distribution — Copies of the order must be delivered within 10 days of the effective date to all principals, officers, directors, managers, employees with managerial responsibilities related to the order's subject matter, and relevant agents [1].
- Receipt Confirmation — Within 30 days of delivery, signed and dated acknowledgments of receipt must be obtained from all individuals and entities who received a copy of the order [1].
Prohibited Representations and Evidence Standards
The order prohibits DoNotPay from making specific misleading or unsubstantiated representations related to its "Covered Product or Service," which includes the DoNotPay Service and any other Internet-enabled product or service purportedly providing "Professional Services" [1].
Specifically, DoNotPay is prohibited from representing, expressly or by implication
- That a Covered Product or Service operates like a human lawyer, including by applying laws to specific situations, relying on legal expertise to avoid complications, or detecting legal violations and advising on fixes [1].
- About the relative or absolute performance, attributes, benefits, or effectiveness of a Covered Product or Service, including that it performs a Professional Service like a professional in the relevant field [1].
These representations are banned unless they are non-misleading and supported by "competent and reliable evidence" [1]. This evidence must consist of tests, analyses, research, studies, or other evidence based on the expertise of professionals in the relevant area, conducted and evaluated objectively by qualified persons, and generally accepted in the profession to yield accurate and reliable results [1].
Additionally, DoNotPay must not misrepresent
- The ability of a Covered Product or Service to analyze or evaluate a website or document for federal and state law violations [1].
- That a Covered Product or Service will save consumers legal fees [1].
- The features, benefits, or attributes included with the purchase of or subscription to a Covered Product or Service [1].
Customer Notification and Recordkeeping Requirements
DoNotPay is required to notify eligible customers about the FTC settlement [1]. Eligible customers include new subscribers to the DoNotPay Service between January 1, 2021, and December 31, 2023, and any identified thereafter within a one-year eligibility period from the order's issuance date [1].
The company must email these customers a notice in the form provided in Attachment A of the order [1]. The initial notification to all identified eligible customers must occur within 180 days after the order's issuance date [1]. Any eligible customers identified subsequently must be notified within 30 days of their identification [1]. A report summarizing compliance with the notification program, sworn under penalty of perjury, is due one year after the issuance date [1].
The order also establishes extensive recordkeeping requirements for 10 years from the issuance date, with records to be retained for 5 years [1]. These include
- Accounting records showing revenues, costs, and net profit/loss [1].
- Personnel records for individuals involved in order-related services [1].
- Records of all consumer complaints and refund requests, and responses [1].
- Records demonstrating full compliance with the order [1].
- Copies of unique advertisements or marketing materials subject to the order [1].
- For 5 years from the last dissemination of any covered representation, all materials relied upon for the representation, and any evidence that contradicts or calls into question the representation [1].
Ongoing Reporting and Monitoring
DoNotPay must submit compliance reports to the Commission [1]. An initial compliance report, sworn under penalty of perjury, is due one year after the order's issuance date, and annually thereafter for three years [1]. These reports must detail the company's contact information, business activities, and how it complies with each provision of the order, including changes made [1].
For 10 years after the issuance date, DoNotPay must submit a compliance notice within 14 days of any change to designated points of contact or the structure of any entity that may affect compliance obligations [1]. Notice of any bankruptcy petition or similar proceeding must also be submitted within 14 days of filing [1].
The FTC retains broad authority to monitor compliance, including requesting additional reports, inspecting records, and communicating directly with DoNotPay personnel [1]. The Commission may also use lawful means, including posing as consumers, to monitor compliance without prior notice [1].
Potential enterprise implications
How does the enterprise identify all AI systems or internet-enabled products providing "Professional Services" that are now subject to the FTC's prohibitions on misleading representations and the "competent and reliable evidence" standard? [1]
What specific representations about "Covered Product or Service" are now prohibited unless supported by "competent and reliable evidence" as defined in the Order? [1]
Given DoNotPay's principal office is in London, United Kingdom, what cross-jurisdictional operational burdens arise from complying with the FTC's recordkeeping and reporting obligations? [1]
Which teams (e.g., legal, product, marketing, MLOps) are responsible for creating and retaining the specific records, including all evidence for representations and contradictory evidence, for 5-10 years as mandated by the order? [1]
What is the exact effective date of the FTC Order, and how are the 10-day deadlines for sworn acknowledgment and order distribution being tracked to ensure timely compliance? [1]