Insights

On April 21, 2025, the FTC filed an enforcement action against Uber alleging that Uber enrolled consumers in Uber One without proper consent, created substantial barriers to cancellation, and misrepresented the financial benefits of the subscription. The claims include violations of the FTC Act—which prohibits unfair and deceptive acts in commerce—and the Restore Online Shoppers’ Confidence Act (“ROSCA”)—which prohibits charging consumers for goods and services sold on the internet through a negative option (i.e., failing to cancel a subscription, unless the seller clearly discloses all material terms of the transaction before obtaining the consumer’s information and obtains the consumer’s expressed informed consent for the charges and provides simple mechanisms for the consumer to stop the recurring charges).

On April 14, 2025, ClassPass, a web-based company offering subscription services to third-party fitness classes, petitioned for rehearing en banc of the Ninth Circuit’s Chabolla v. ClassPass decision, which held that ClassPass’ users were not bound by the terms of ClassPass’ “sign-in wrap” agreement. The ruling has significant consequences for online companies using sign-in wrap agreements and for online contract formation and enforcement more generally. A sign-in wrap is a type of online agreement in which the agreement is hyperlinked on the website, but the user is not required to access, review, confirm an understanding, or otherwise affirmatively “assent” to be bound. If the Ninth Circuit does not grant ClassPass’ request and issue a new ruling in Chabolla, this case may signal the death knell for sign-in wraps, resulting in significant disruption, friction, and ultimately lower conversion for online companies who will be forced to redesign their sign-up flows to be click-wrap agreements (online agreements that require the user to affirmatively accept a company’s terms of use by clicking an assent box or button). Short of that, this decision increases business risk given that there are now conflicting opinions both within the Ninth Circuit and between the various Circuits.

On April 26, 2024, the Department of Health and Human Services’ Office for Civil Rights (“OCR”) published a final rule entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”) to address new privacy issues that have resulted in the wake of the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization (“Dobbs”). The Final Rule aims to strengthen reproductive health care privacy under the Health Insurance Portability and Accountability Act and its implementing regulations (collectively, “HIPAA”) by prohibiting covered entities and business associates (collectively, “regulated entities”) from using or disclosing protected health information (“PHI”) to investigate or impose liability on any person for the “mere act” of seeking, obtaining, providing, or facilitating lawful reproductive health care, or to identify any person for such purposes.