How NY's FAIR Act Mirrors CFPB State Recommendations
Law360
On March 13, New York Attorney General Letitia James announced the Fostering Affordability and Integrity through Reasonable, or FAIR, Business Practices Act,[1] aimed at strengthening consumer protections, cutting costs, reducing junk fees and curbing predatory lending.[2]
This bill represents New York's acceptance of the proverbial torch of consumer protection that Rohit Chopra's Consumer Financial Protection Bureau attempted to pass to the states in the waning hours of President Joe Biden's administration.
On Jan. 14, the bureau issued a report titled "Strengthening State-Level Consumer Protections: Promoting Consumer Protection Federalism."
In its associated announcement, the bureau noted
Over the last century, in response to evolving markets, states have refreshed the core standards of fair dealing that form the bedrock of consumer protection law. States should once again refresh their [unfair or deceptive acts or practices] statutes to address the challenges of the modern economy.[3]
The CFPB urged states to modernize fair dealing standards, and within weeks, New York responded by advancing legislation to amend Section 349 of its General Business Law.[4]
Section 349 was enacted 55 years ago as a broad consumer protection measure (at the time).
Critically, Section 349 does not currently prohibit unfair practices, making the law "antiquated and inadequate," according to the attorney general.[5]
While the FAIR Business Practices Act doesn't adopt all CFPB recommendations, it includes many. This article addresses the CFPB's recommendations and New York's response.
"Incorporate 'abusive' into state law."
The consumer protections report first recommends including the Consumer Financial Protection Act's prohibition on "abusive" acts or practices. The existing provision of Section 349 begins with the simple statement, "Deceptive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service in this state are hereby declared unlawful," and does not define or illustrate deceptive practices.[6]
In contrast, the proposed FAIR Business Practices Act expands the prohibition to unfair, deceptive, or abusive acts and practices and defines each key term.
Notably, the new definition of abusive conduct follows the consumer protections report's recommendations nearly verbatim.[7] These changes, if enacted, will bring New York's law in line with the 42 other states and federal law that already prohibit unfair practices.
Implement "[s]tronger remedies and tools for investigation and enforcement."
The proposed FAIR Business Practices Act does not include the CFPB's specific recommendations to empower the attorney general's office by granting market-monitoring authority similar to the CFPB's, to grant authority to municipal and city enforcers, or to provide presuit investigatory power.[8]
However, the proposed legislation does expand the remedies for residents, somewhat similar to those available under Title 12 of the U.S. Code, Section 5565(a)(2), according to the report.[9]
Section 349 already permits the attorney general to sue for unlawful practices and seek restitution. The amended act expands this authority to include actions against anyone doing business with New York consumers or small businesses, regardless of their physical location.[10]
It also permits lawsuits based on a single transaction or incident, addressing prior court-imposed limits that restricted relief for New Yorkers.[11] The FAIR Business Practices Act increases the $5,000 civil penalty provision of Section 350-d to include the greater of $15,000 or three times the value of restitution for each violation that was knowing or willful or occurred "during an abnormal disruption of the market."[12]
The act also significantly increases the available damages for a consumer plaintiff from the greater of actual damages or $50 to $1,000 in statutory damages and any actual damages.
The new act also allows for treble damages for a consumer plaintiff if a court finds that the defendant willfully or knowingly violated the law and mandates the payment of attorney fees and expenses such as expert witness fees to a prevailing plaintiff.[13]
Further, the proposed law creates a new class of "vulnerable persons," defined as anyone aged 18 years or less or 65 years and older; on active duty military services or is a veteran; with a physical or mental impairment that substantially limits one or more major life activities; or with limited English proficiency.[14]
For such vulnerable persons, additional penalties of $5,000 to $10,000 shall be awarded in addition to the normal damages.
"Eliminate requirement to prove monetary injuries."
The CFPB encouraged states to revise their unfair, deceptive or abusive acts or practices, or UDAAP, laws to remove any requirement to prove monetary harm.
As the bureau noted, "federal courts have limited the ability of private plaintiffs to pursue certain non-economic claims in federal court, and several states statutorily limit or prohibit recovery for hard-to-quantify harms by requiring consumers to prove that they suffered a loss of 'money or property.'"[15]
While the proposed FAIR Business Practices Act does not incorporate the suggested "burden of proof" language from the CFPB, it does expressly provide that the term "injury" means "any impairment of a person's interests," and "substantial injury" means any "substantial impairment of a person's interests, whether or not such impairments or substantial impairments to interests are quantifiable, economic, or monetary in nature, including but not limited to loss of time, loss of privacy, or loss of security."[16]
This expansive language eliminates any need for an individual litigant or the attorney general to establish a financial loss.
"Ensure consumer protections also protect businesses."
The CFPB's consumer protections report also encouraged states to "exercise or expand their consumer protection authority to protect businesses" because the boundary between personal and business finances for an entrepreneur "may be hazy — or not exist at all."[17]
However, New York courts, including the U.S. District Court for the Southern District of New York in 2022 in Dwyer v. Allbirds Inc., have historically held that Section 349 only applies to individual consumers. The plaintiff must show "first, that the challenged act or practice was consumer-oriented; second, that it was misleading in a material way; and third, that the plaintiff suffered injury as a result of the deceptive act," per the Court of Appeals of the State of New York in 2000 in Stutman v. Chemical Bank.
In clear rejection of the courts' interpretation, proposed new Section 348 states that,
"Revitalize private enforcement."
The CFPB's consumer protections report lambasted businesses' use of arbitration clauses, enabling cases to be "prosecuted in secret," and lamented the federal courts' "more restrictive standards for certifying a class action."[20]
The CFPB urged states to expand UDAAP laws with public enforcement tools like qui tam actions and nonprofit prosecution. New York's FAIR Business Practices Act omits these but adds a new right to file class actions.
The proposed law provides that
"Provide strong and enforceable consumer data and privacy rights."
The CFPB's consumer protections report encouraged states to embed consumers' privacy rights into their UDAAP laws, and it provided a laundry list of recommendations in this space.[21]
New York's proposed FAIR Business Practices Act does not include any of these recommendations, but it does notably include loss of privacy as a type of substantial injury that could be actionable.
Further, the attorney general's press release referred to data breaches as one of the "wide array of scams" that the new law seeks to protect against.[22]
The attorney general's office has previously stated that
"Create bright-line prohibitions of junk fees."
The final item on the Chopra-led CFPB's wish list for state UDAAP laws was one of its favorite topics, so-called junk fees. The bureau advised states to expressly include junk fees in their UDAAP laws and provided suggested language around hidden fees, misleading fees and price gouging.[25]
While the FAIR Business Practices Act doesn't mention junk fees explicitly — or consumer fees of any kind — the attorney general's press release on the new law expressly included junk fees.[26]
Conclusion
The FAIR Business Practices Act bill will significantly expand the power of both the attorney general and civil litigants to seek redress for unfair and deceptive trade practices.
Companies doing business in New York should carefully review the broad scope of the new law and align their practices with both the express language in the law and the attorney general's detailed press release regarding her vision of enforcement through the act.
[1] The Fostering Affordability and Integrity through Reasonable Business Practices Act.
[2] Id. The Attorney General's press release included comments from U.S. Senator Elizabeth Warren ("we need to fight back at the federal and local level"; "I urge other states to protect Americans from getting tricked and trapped by big banks and giant corporations") and former CFPB Director Rohit Chopra ("With stronger laws on the books, Attorney General James and state law enforcement across the country can stop the scourge of junk fees and other crimes against consumers.").
[3] Consumer Fin. Prot. Bureau, Strengthening State-Level Consumer Protections, (Jan. 14, 2025), https://www.consumerfinance.gov/data-research/research-reports/strengthening-state-level-consumer-protections/.
[4] N.Y. Gen. Bus. Law § 349 (Deceptive acts and practices unlawful). Note that section 349 is on the CFPB's list of State Covered Laws for the Nonbank Registration Rule. See 12 C.F.R. § 1092, App. A.
[5] Attorney General James Takes Action to Protect New York Consumers and Small Businesses, Office of the New York State Attorney General (March 13, 2025), https://ag.ny.gov/press-release/2025/attorney-general-james-takes-action-protect-new-york-consumers-and-small.
[6] N.Y. Gen. Bus. Law § 349(a).
[7] See supra note i at 22-23.
[8] See supra note i at 24.
[9] Id.
[10] See supra note vii at § 349(b).
[11] Id. at § 348.
[12] Id. at § 350-d(1).
[13] Id. at § 349(h)(1).
[14] Id. at § 349(c)(previously only including "elderly persons").
[15] See supra note i at 25.
[16] See supra note at § 349(a)(5).
[17] See supra note i at 26-27.
[18] See supra note at § 348.
[19] Id. at 349(d).
[20] See supra note i at 28-29.
[21] Id. at 31.
[22] See supra note iv ("This legislation will strengthen New York's consumer protection law, GBL § 349, to protect New Yorkers from a wide array of scams, including…data breaches…").
[23] Website Privacy Controls, Office of the New York State Attorney General (Last updated July 15, 2024), https://ag.ny.gov/resources/organizations/business-guidance/website-privacy-controls.
[24] Notably, New York does not currently have a comprehensive state consumer privacy law. On January 22, 2025, the New York State Legislature passed Senate Bill (S) 929, known as the New York Health Information Privacy Act but the bill has not yet been sent to the Governor's desk for signature. And the proposed New York Privacy Act, which would be a comprehensive privacy law, is currently pending in both chambers. See Senate Bill S3044 and Assembly Bill A8158.
[25] See supra note i at 32-33.
[26] See supra note iv ("This legislation will strengthen New York's consumer protection law, GBL § 349, to protect New Yorkers from a wide array of scams, including…junk fees….").
