Last Week, This Morning

March 16, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On March 11, the Federal Trade Commission announced an Advanced Notice of Proposed Rulemaking that seeks public comment on the need for amendments to its Negative Option Rule. We previously reported on the FTC's submission of a draft ANPRM to the Office of Information and Regulatory Affairs for review. Negative option plans generally involve a seller interpreting a consumer's silence or inaction as consent to continue to receive a particular product or service; a consumer must actively cancel the product or service to avoid being charged by the seller.

In July 2025, the U.S. Court of Appeals for the Eighth Circuit vacated the FTC's 2024 amendments to the Negative Option Rule right before the compliance deadline for those amendments, finding procedural deficiencies in the rulemaking process. The 2024 amended rule generally required sellers to obtain, and maintain records of, unambiguous affirmative consent to a negative option feature and to provide a simple mechanism for cancellation that is as easy to use as the mechanism the consumer used to consent to the subscription.

The FTC currently seeks public comment to determine whether and how it should use its authority to address negative option marketing. Specifically, the FTC is seeking information on the following topics:

• the extent to which businesses market products and services using negative options and how these negative option programs operate;
• practices that prevent consumers from understanding the terms of a negative option program, result in consumers being enrolled without their express informed consent, or deter consumers from canceling their enrollments and whether such practices are prevalent in the marketplace;
• specific ways to address unfair or deceptive negative option practices; and
• supporting market studies, economic data, or other empirical evidence.

Comments on the ANPRM must be received by April 13, 2026.

Amicus Brief(ly): The FTC has been steadfast in its concerns about negative option advertising, as evidenced by its continued pursuit of a rule to address the practice. As we have previously reported, the regulator's concerns focus on disclosures, ease of cancellation, misleading statements, and whether to require an expression of consumer consent as opposed to interpreting silence as consent. The FTC takes a step back with the ANPR, seeking information about whether changes to the existing rule are even necessary. Providers and consumer advocates have a month to share their comments and any supporting data, and from there we will see how the FTC reacts.

On March 13, the director of the Federal Trade Commission's Bureau of Consumer Protection, Christopher Mufarrige, announced that he is sending letters to 97 auto dealerships advising them that they may be deceptively advertising prices for cars that are lower than what they actually charge consumers and that advertised prices must be transparent and truthful. The letter provides examples of illegal pricing practices, including:

• advertising a price that does not reflect all required fees;
• advertising a price that reflects rebates or discounts not available to all consumers;
• advertising a price that fails to take into account the amount of an additional required down payment;
• conditioning the advertised price on consumers using dealer financing;
• requiring consumers to buy additional items not reflected in the advertised price; and
• advertising unavailable or non-existent vehicles.

In the letter, Mufarrige "encourage[s] [the dealership] to review [its] practices, including by making sure the prices [it] advertise[s] include all required fees and charges aside from required government charges, to ensure [it is] complying with applicable laws. This would include, at a minimum, evaluating ... advertised prices and actual prices and confirming they match." The letter "is not intended to be a comprehensive statement of concerns that may exist about [the] dealership or dealership group. Nor is it intended to represent any conclusions on whether [the] dealership or dealership group is engaging in these practices." The letter notes that the FTC will take additional action as warranted.

Amicus Brief(ly): If readers feel like they are hearing a lot about dealer price advertising practices, we'll confirm that your mind is not playing tricks on you. It is happening. State attorneys general have pursued dealers for alleged deceptive and misleading practices, including the six examples listed in the FTC's letter. These concerns have persisted through administration changes and across state lines. We have said this before, but it bears repeating while dealer price advertising concerns remain a focus for regulators: dealers should review their advertisements, marketing programs, and corresponding sales (and maybe customer complaint data) to make sure their advertisements are clear, complete, and accurate. FTC settlements can be expensive.

On March 10, on the heels of her letter to major auto financing companies and servicers requesting information on vehicle repossessions, U.S. Senator Elizabeth Warren (D-Mass.) sent a letter to five major auto financing companies seeking information concerning the sale and financing of vehicles by servicemembers during the period from January 1, 2023, through December 31, 2025.

In her current letter, Warren states: "A recent report showed that between 2018 and 2022, service members with comparable credit scores to civilians were paying interest rates that were on average 0.35 percentage points higher when purchasing new cars and 0.28 percentage points higher when purchasing used cars. I am particularly concerned since service members could face more professional and personal consequences, such as losing their security clearance, if they default on an auto loan - a risk that is greater when they are being charged unfairly high rates." Warren also claims that "there has been an unfortunate history of allegations that unscrupulous auto dealers and lenders have taken advantage of service members through fraud, deceit, scams, and unlawful practices."

Warren requested written responses to the letters by March 24, 2026.

Amicus Brief(ly): Ah, Senator Warren, you must know that a credit score does not a whole creditworthiness story tell. But even if she does, her letter identifies a potential concern that finance companies should be prepared to address. Specifically, if servicemembers are paying more for their vehicle financing than similarly situated non-servicemembers, there has to be a business justification for it. For example, if a servicemember and a civilian have the same credit score but the civilian earns an income double that of the servicemember, all other things being equal, a creditworthiness analysis would tell us that the civilian is a lower credit risk than the servicemember. A comparison of credit scores alone in this example does not give us enough information to make that decision. So, as is the case with any claims of pricing discrimination, finance companies should be prepared to defend the decisions their underwriting models make, pointing to non-discriminatory factors that inform pricing based on objective creditworthiness criteria.

The Oregon legislature recently passed House Bill 4116, which would opt consumer finance loans made in Oregon out of the Depository Institutions Deregulation and Monetary Control Act of 1980 ("DIDMCA"). H.B. 4116 amends the Oregon Consumer Finance Act by declaring that Oregon "does not want any of the amendments set forth in section 521 of the [DIDMCA] to apply to consumer finance loans made in this state."

Section 521 of the DIDMCA allows an FDIC-insured state-chartered bank to charge the interest rate permitted by the state in which the bank is located and export that rate into other states, even if the borrower's state of residence would not permit that rate under its state law. Proponents of such opt outs argue that Section 525 of the DIDMCA permits states to opt out of Section 521. If a state opts out, a state-chartered bank making loans to residents of that state must comply with the usury limit of the opt-out state.

It appears that the intent of H.B. 4116 is for state-chartered banks making consumer finance loans to Oregon residents to comply with the rate limitations under the CFA. A consumer finance loan is a loan or line of credit that is unsecured or secured by personal or real property and that has periodic payments and terms longer than 60 days. Under the CFA, a licensee may charge a finance charge, expressed as an annual percentage rate, that does not exceed the greater of 36% or 30% in excess of the discount window primary credit rate. The director of the Oregon Department of Consumer and Business Services, on the second Friday of December each year, publishes an order establishing the discount rate for new loans made in the subsequent year. In recent years, the maximum finance charge on a consumer loan has been consistently 36%. Accordingly, if the bill is enacted, a state bank making loans of $50,000 or less to Oregon residents would be limited to charging no more than 36% interest.

Of note, though, is that out-of-state banks are not subject to Oregon's general civil usury limit under the current law. Oregon's general civil usury law, which imposes a usury limit of (effectively) 12% on loans of $50,000 or less, expressly exempts federally insured depository institutions, whether state or federally chartered, from the 12% usury limit. H.B. 4116 does not amend Oregon's general civil usury law. It also does not amend the express reference in the CFA to the general civil usury law, which has historically been interpreted to mean that persons exempt from the usury limit, and persons making loans exempt from the usury limit, do not need the optional CFA license that allows them to make loans at interest rates that exceed the usury limit.

If signed by the governor, H.B. 4116 takes effect on the 91st day following adjournment of the 2026 Oregon regular legislative session.

Amicus Brief(ly): While the Colorado DIDMCA opt-out appeal for an en banc rehearing is pending before the Tenth Circuit, Oregon forged ahead with its own bill. Oregon modified its CFA a few years ago to capture non-bank providers in bank partnerships by requiring licensing for just about any participant in the marketing, offering, and servicing of CFA loans. Now, Oregon is attempting to regulate fintech lending even more closely by passing this interest rate bill that purports to limit the interest rates out-of-state state-chartered banks can charge Oregon borrowers on CFA loans. We anticipate that this bill will also end up the subject of litigation, and eventually the Supreme Court may have a chance to look at and decide the important issue of where a loan in a bank partnership is "made" for purposes of interest rate exportation - a key determination in any state bank partnership lending program. We and our fintech subscribers are tracking opt-out legislation and litigation with keen interest.

The Colorado Attorney General's Office, in conjunction with the administrator of the Colorado Fair Debt Collection Practices Act, recently reached a settlement with a debt collector to resolve allegations of unlawful debt collection practices, including failing to clearly disclose its identity in communications with consumers and making collection calls to consumers in excess of limits set by state law. The debt collector held a Colorado collection agency license.

The lawsuit specifically alleged that the debt collector contracted with a provider of ambulance transportation services to provide both first-party servicing and third-party debt collection services for accounts placed with the debt collector. The debt collector allegedly mailed initial collection letters to consumers in its own name, seeking to collect debts the consumers owed to the provider. The debt collector then mailed consumers a "Resolution Notification" letter "on behalf of [the provider]" attempting to settle the debt. The provider's name was on this letter, but the mailing address listed in the letter belonged to the debt collector. The Resolution Notification letter stated that "this amount remains past due. In an effort to resolve this matter we have directed the previously assigned collection agency to cease their collection communications and reach out to you ourselves to resolve the unpaid balance [emphasis added]." The lawsuit alleged that this letter led consumers to believe that it came directly from the provider and not the debt collector, in violation of the CFDCPA. The debt collector acknowledged that it sent 1,136 such letters - i.e., letters containing the provider's rather than the debt collector's name - to 541 Colorado consumers.

The lawsuit also alleged that, in an apparent contradiction to the letter's statement that "we have directed the previously assigned collection agency to cease their collection communications," the debt collector continued making debt collection phone calls to consumers, sometimes placing more than seven debt collection calls within a seven-day period, in violation of the CFDCPA.

In addition to a fine of $43,500 and agreeing to cease any false, deceptive, or misleading representations in connection with the collection of any debt, the terms of the settlement provide that the debt collector, "[w]hen engaged in Third-Party Collection," "[m]ay not thereafter switch, recategorize, or otherwise transfer a consumer's account to First-Party Collection" and "[m]ust provide its name and contact information in any written or verbal communication with the consumer."

Amicus Brief(ly): This case highlights the conundrum of "first-party servicing," a term that has a general industry understanding but is not defined in the federal FDCPA or state analogs that look just like the federal statute. These laws make it a deceptive collection practice for a "debt collector" to use any name in collection other than its true business name. But it is a common practice in outsourced servicing or "early-out" collections for third-party servicers to operate in the name of their creditor clients. The practice is not designed to deceive customers. To the contrary, creditors want customers to be comfortable in their servicing relationships, and most consumers are more comfortable receiving correspondence from the creditor or servicer whose name they know, not a third party. The issue does not typically get a lot of regulator attention because of the relatively low risk of detection. But, in this case, it looks like the debt collector crossed its own wires in communicating with customers and switched party voices while servicing, creating some potential confusion and leading to this lawsuit.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.