2025-02575NoticeWallet

FTC Puts GoDaddy on Notice for Better Customer Protections

Published Date: 2/13/2025

Notice

Summary

The Federal Trade Commission (FTC) is reviewing a proposed agreement with GoDaddy Inc. to stop unfair or deceptive business practices. GoDaddy must follow new rules to protect customers better, and the public can share their thoughts by March 17, 2025. This deal aims to keep online services honest without any immediate fines but with a promise to play fair going forward.

Analyzed Economic Effects

4 provisions identified: 4 benefits, 0 costs, 0 mixed.

Must Build a Strong Security Program

GoDaddy must establish, implement, and document a comprehensive information security program tailored to the specific security shortcomings alleged in the complaint. Those shortcomings include failures to inventory and manage assets; manage software updates; assess risks; use multi-factor authentication; log security events; monitor for threats (including active detection and file integrity monitoring); segment networks; and secure connections to services that provide access to consumer data.

Independent Audits and 20-Year Oversight

GoDaddy must obtain an initial and then biennial (every two years) information security assessment by an independent, third‑party professional for 20 years, and must cooperate with the assessor. The Proposed Order also states it will remain in effect for 20 years, with certain exceptions.

Ban on Misleading Security Claims

GoDaddy is forbidden from making false or misleading statements about how well it protects website hosting services and consumers' personal information. The ban explicitly covers claims about security, the use of reasonable or appropriate measures, use of security technologies or monitoring, and membership or adherence to privacy/security programs, including the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.

Executive Certifications and Incident Reporting

GoDaddy must provide annual certifications of compliance with the Order from a senior executive officer of each Respondent and must submit reports to the Commission if they experience additional data incidents. The Order also includes recordkeeping and other reporting provisions the Commission can use to monitor compliance.

Personalized for You

How does this regulation affect your finances?

Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Key Dates

Published Date
2/13/2025

Department and Agencies

Department
Independent Agency
Agency
Federal Trade Commission
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register