---
title: "FTC v. Wyndham: FTC Authority on Cybersecurity Breaches"
description: "In FTC v. Wyndham, Third Circuit Court of Appeals affirms the FTC’s authority to regulate \"unfair and deceptive acts” under Section 5 of the FTC Act."
image: https://spzlegal.com/hubfs/79235018_b8d6e1fc1c_o.jpg
---

[Skip To Content](https://spzlegal.com/blog/data-privacy/ftc-v-wyndham#main-content)

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

- [Clients](https://spzlegal.com/our-clients) 
    - [Featured Clients](https://spzlegal.com/our-clients)
    - [Case Study: Verto Education](https://spzlegal.com/verto-case-study)
    - [Case Study: Kong Studios](https://spzlegal.com/kong-studios-case-study)
    - [Case Study: WindBorne](https://spzlegal.com/windborne-case-study)
    - [Case Study: Tango](https://spzlegal.com/tango-case-study)
    - [Case Study: Sown To Grow](https://spzlegal.com/sown-to-grow-case-study)
    - [Case Study: Capture6](https://spzlegal.com/capture6-case-study)
    - [Case Study: Datava](https://spzlegal.com/datava-case-study)
    - [Case Study: Voxel](https://spzlegal.com/from-scrappy-startup-to-selling-to-fortune-100)
- [Team](https://spzlegal.com/team) 
    - [About Us](https://spzlegal.com/team)
    - [Becky Mancero](https://spzlegal.com/team/becky-mancero)
    - [David De La Flor](https://spzlegal.com/team/david-de-la-flor)
    - [Elizabeth Thorne](https://spzlegal.com/team/elizabeth-thorne)
    - [Gea Kang](https://spzlegal.com/team/gea-kang)
    - [Hannah Porter](https://spzlegal.com/team/hannah-porter)
    - [Hash Zahed](https://spzlegal.com/team/hash-zahed)
    - [Jessica Sulahian](https://spzlegal.com/team/jessica-sulahian)
    - [Morgan Kasenchak](https://spzlegal.com/team/morgan-kasenchak)
    - [Paige Southworth](https://spzlegal.com/paige-southworth)
    - [Ryan Shaening Pokrasso](https://spzlegal.com/team/ryan-shaening-pokrasso)
    - [Sam Taylor](https://spzlegal.com/team/sam-taylor)
    - [Tami Gore](https://spzlegal.com/team/tami-gore)
    - [Specialists](https://spzlegal.com/our-partners)
- [Services](https://spzlegal.com/business-law-services) 
    - [Formation & Corporate](https://spzlegal.com/business-law-services/formation)
    - [Mergers & Acquisitions](https://spzlegal.com/business-law-services/mergers-acquisitions)
    - [Funding](https://spzlegal.com/business-law-services/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/business-law-services/employment)
    - [Data Privacy](https://spzlegal.com/business-law-services/data-privacy)
    - [IP Protection](https://spzlegal.com/business-law-services/ip-protection)
    - [Commercial Agreements](https://spzlegal.com/business-law-services/sales-agreements)
- [Startup Center](https://spzlegal.com/startup-center) 
    - [Formation & Corporate](https://spzlegal.com/startup-center/formation-and-corporate-topics)
    - [Mergers & Acquisitions](https://spzlegal.com/startup-center/mergers-and-acquisitions)
    - [Funding](https://spzlegal.com/startup-center/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/startup-center/hiring)
    - [IP Protection](https://spzlegal.com/startup-center/ip-protection)
    - [Data Privacy](https://spzlegal.com/startup-center/data-privacy)
    - [Commercial Agreements](https://spzlegal.com/startup-center/commercial-agreements)
- [Blog](https://spzlegal.com/blog)
- [Contact](https://spzlegal.com/contact)

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

# FTC v. Wyndham: The FTC Has Authority to Regulate Cybersecurity Breaches

[Data Privacy](https://spzlegal.com/blog/tag/data-privacy)

![](https://spzlegal.com/hs-fs/hubfs/79235018_b8d6e1fc1c_o.jpg?width=760&height=428&name=79235018_b8d6e1fc1c_o.jpg)

In an [historic decision](https://www.ftc.gov/news-events/news/press-releases/2015/12/wyndham-settles-ftc-charges-it-unfairly-placed-consumers-payment-card-information-risk) with wide-reaching ramifications for data privacy and security, the Third Circuit Court of Appeals has affirmed the Federal Trade Commission’s authority to regulate cyberspace under the “unfair and deceptive acts” provision in § 5 of the FTC Act (*FTC v. Wyndham*). 

The appellate court’s ruling is the latest development in the ongoing saga of *FTC v. Wyndham Hotels,* a pivotal suit concerning the Commission’s ability to [hold Wyndham Hotels accountable](https://www.ftc.gov/news-events/news/press-releases/2015/08/statement-ftc-chairwoman-edith-ramirez-appellate-ruling-wyndham-hotels-resorts-matter) for three different data breaches that occurred over the space of two years. The FTC is alleging that the breaches, which resulted in millions of dollars in fraudulent charges billed to Wyndham guests’ credit cards, were a direct result of shoddy cybersecurity practices on the part of Wyndham and three subsidiaries. In a 2014 motion to dismiss, Wyndham asked a New Jersey district court to throw out the FTC’s suit, questioning the Commission’s authority to regulate data privacy practices under the FTC ACT and raising issues around whether or not the FTC’s provisions provided fair notice of a failure in compliance. The district court denied the motion, and the Third Circuit heard an immediate appeal on “whether the FTC has authority to regulate cybersecurity under the unfairness prong of § 45(a); and, if so, whether Wyndham had fair notice its specific cybersecurity practices could fall short of that provision.”

On August 24, 2015, the Third Circuit [affirmed the denial of Wyndham’s motion to dismiss.](https://www.ftc.gov/news-events/news/press-releases/2015/12/wyndham-settles-ftc-charges-it-unfairly-placed-consumers-payment-card-information-risk) Judge Thomas Ambro’s opinion confirmed the FTC’s ability to prosecute cybersecurity practices under the FTC Act, and claimed that the FTC’s past actions, investigations and public statements combined with the Act itself provided ample notice of potential liability. While the litigation will continue, the Third Circuit’s opinion cements the FTC’s authority in the data privacy arena and underscores the importance of developing and following commercially reasonable technical, physical, and administrative security measures with regard to [personally identifiable information](https://spzlegal.com/blog/data-privacy/personally-identifiable-information). 

[Read the full opinion](https://www.ftc.gov/system/files/documents/cases/150824wyndhamopinion.pdf).

[More On cybersecurity and the FTC](https://spzlegal.com/blog/data-privacy/ftc-data-privacy-enforcement) [Get Help Complying](https://spzlegal.com/contact)

---

*DISCLAIMER: The information in this article is provided for informational purposes only and should not be construed or relied upon as legal advice. This article may constitute attorney advertising under applicable state laws.*

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

Categories

- [Funding](https://spzlegal.com/blog/tag/funding)
- [Incorporation](https://spzlegal.com/blog/tag/incorporation)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Contracts](https://spzlegal.com/blog/tag/contracts)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [M&A](https://spzlegal.com/blog/tag/ma)
- [Firm Culture](https://spzlegal.com/blog/tag/firm-culture)
- [News](https://spzlegal.com/blog/tag/news)
- [Social Enterprise](https://spzlegal.com/blog/tag/social-enterprise)
- [Acquired](https://spzlegal.com/blog/tag/acquired)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Client Engagement](https://spzlegal.com/blog/tag/client-engagement)
- [Nonprofit](https://spzlegal.com/blog/tag/nonprofit)
- [AI](https://spzlegal.com/blog/tag/ai)
- [Artificial Intelligence](https://spzlegal.com/blog/tag/artificial-intelligence)

Recent Posts

- [Becky Mancero Recognized by Best Lawyers: Ones to Watch for Second Consecutive Year](https://spzlegal.com/blog/becky-mancero-best-lawyers-ones-to-watch-2026)
- [What We Fix in Diligence Over and Over Again Before a Financing or Exit](https://spzlegal.com/blog/startup-legal-issues-before-financing-exit)
- [Becky Mancero on the Melissa Widner Podcast: Cap Tables, Equity Mistakes, and AI in the Legal World](https://spzlegal.com/blog/becky-mancero-on-the-melissa-widner-podcast-cap-tables-equity-mistakes-ai-in-the-legal-world)
- [Spinning Out a Product Into a New Startup: Legal Issues Founders Need to Solve Early](https://spzlegal.com/blog/spinning-out-product-new-startup-legal-guide)
- [Converting an LLC to a Corporation: When It Makes Sense and How to Do It Without Creating a Mess](https://spzlegal.com/blog/converting-llc-to-corporation-startup-guide)
- [The Role of LOIs in M&As: Structuring Letters of Intent](https://spzlegal.com/blog/the-role-of-lois-in-mas-structuring-letters-of-intent)
- [Exit Structures: Mergers, Acquisitions, & Tax Treatment](https://spzlegal.com/blog/exit-structures-mergers-acquisitions-tax-treatment)
- [Due Diligence Best Practices: Be Prepared for M&A Success](https://spzlegal.com/blog/due-diligence-best-practices-be-prepared-for-ma-success)

Locations

**San Francisco Bay Area, California**

**Milwaukee, Wisconsin**

**Los Angeles, California**

**Denver, Colorado**

**Miami, Florida**

**Austin, Texas**

Contact Us

[Email](https://spzlegal.com/contact)

Follow Us

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

Startup Topics

- [Formation](https://spzlegal.com/blog/tag/incorporation)
- [Funding](https://spzlegal.com/blog/tag/funding)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [Commercial Agreements](https://spzlegal.com/blog/tag/contracts)
- [M&A Law](https://spzlegal.com/blog/tag/ma)

© 2026 [SPZ Legal, P.C. Startup Lawyers](https://spzlegal.com/)

- [Terms of Use](https://spzlegal.com/terms)
- [Privacy Policy](https://spzlegal.com/privacy)

[![California Chambers Spotlight 2025 Award](https://spzlegal.com/hs-fs/hubfs/ca-chamber-spotlight-2025-badge.jpg?width=300&height=300&name=ca-chamber-spotlight-2025-badge.jpg)](https://chambers.com/law-firm/spz-legal-p-c-120:23727975)

 DISCLAIMER: The information on this website is provided for informational purposes only and may not be updated over time. Nothing on this website should be construed as legal advice or relied upon in any way. No attorney-client relationship is intended to be created through this website. This website may be considered attorney advertising in some states. Prior results do not guarantee a similar outcome.

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Aaron Murphy",
    "url" : "https://spzlegal.com/blog/author/aaron"
  },
  "dateModified" : "2026-05-25T14:28:01.105Z",
  "datePublished" : "2019-09-02T01:11:36.000Z",
  "headline" : "FTC v. Wyndham: FTC Authority on Cybersecurity Breaches",
  "image" : [ "https://spzlegal.com/hubfs/79235018_b8d6e1fc1c_o.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://spzlegal.com/blog/data-privacy/ftc-v-wyndham",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg"
    }
  }
}
```