## Facts

- Drizly, LLC operated an e-commerce platform enabling local alcohol retailers to sell and deliver to consumers of legal drinking age and collected consumer personal information through the service.
- The FTC alleged Drizly collected and stored data including names, email and postal addresses, phone numbers, device identifiers, geolocation information, and order history, and in some instances partial payment-related data.
- In 2018, a Drizly employee publicly posted cloud-account login credentials in a code repository, enabling unauthorized use of Drizly’s servers; credentials were later changed.
- The FTC alleged the 2018 incident provided notice of material security weaknesses, but Drizly did not implement a reasonable written security program or basic safeguards such as multi-factor authentication and secure credential handling.
- In 2020, a malicious actor compromised an employee account, obtained access to Drizly’s credentials, accessed Drizly’s database, and stole consumer information affecting about 2.5 million consumers.
- The FTC alleged Drizly made public-facing representations suggesting it used appropriate security measures, despite lacking reasonable controls (e.g., access limits, monitoring, employee training, and a designated senior security leader).
- The FTC named CEO James Cory Rellas individually, alleging he had authority to control relevant practices and failed to implement or properly delegate responsibility for reasonable information security measures.
- The matter proceeded as an FTC administrative action under § 5 of the FTC Act and was resolved by a consent order finalized on January 10, 2023.

## Issues

1. Whether Drizly’s public statements about protecting consumer data were misleading, constituting deception under § 5 of the FTC Act.
2. Whether Drizly’s alleged failure to implement reasonable information security measures, leading to the 2020 breach, constituted an unfair practice under § 5.
3. Whether a consent order may impose forward-looking, individual compliance obligations on a CEO that can apply at qualifying future employers.

## Decision

- The FTC issued a final Decision and Order by consent; respondents did not admit liability but agreed to injunctive relief.
- Drizly was ordered to establish, implement, and maintain a documented information security program with administrative, technical, and physical safeguards, including risk assessments, access controls, monitoring, employee training, and periodic testing and assessments.
- Drizly was ordered to implement data minimization measures, including destruction of personal data not necessary to provide products or services and limits on collection and retention based on a publicly available retention schedule, with documentation and reporting to the FTC.
- The order imposed reporting, recordkeeping, and compliance obligations for a long-term period (including 20 years for Drizly).
- Rellas was subject to a 10-year provision requiring him, in specified roles at qualifying businesses (e.g., majority owner, CEO, or senior officer with security responsibilities at entities collecting data from more than 25,000 individuals), to ensure implementation of an information security program meeting order standards.
- No civil penalties were imposed as part of the settlement; the order created a basis for penalties if the order is later violated.

## Legal Principles

- Under § 5 of the FTC Act, materially misleading representations about data security may constitute a deceptive act or practice.
- A company’s failure to implement reasonable safeguards for consumer personal information, when it causes or is likely to cause substantial consumer injury not reasonably avoidable and not outweighed by benefits, may constitute an unfair act or practice.
- Corrective relief in FTC privacy and security matters may include affirmative security-program requirements (governance, risk assessment, access controls, monitoring, training, and independent assessments), not merely prohibitions on misrepresentations.
- FTC orders may require data minimization measures—deletion of unnecessary data and restrictions on future collection/retention tied to defined business purposes and retention schedules.
- Where an executive has authority over, participates in, or is responsible for the challenged practices, FTC settlement terms may impose individual, forward-looking compliance duties, including obligations that apply in later employment under defined conditions.

## Conclusion

The FTC resolved the matter through a consent order requiring Drizly to adopt a comprehensive information security program and data minimization controls after a breach affecting about 2.5 million consumers, and it imposed time-limited, role- and threshold-based security-program obligations on the CEO personally to address governance failures and deter similar conduct.


In re Drizly, LLC & James Cory Rellas, No. C-4780 (F.T.C. Jan. 10, 2023)