State UDAP Laws (Mini-FTC Acts) and Affiliates
Every state prohibits unfair and deceptive practices, and many let consumers sue directly. Why your FTC compliance also satisfies state deception law.
Long before any state passed a data-privacy law, every state already had a consumer-protection statute prohibiting unfair or deceptive acts and practices — commonly known as a UDAP law, a “mini-FTC act,” or a “little FTC act.” These statutes are the state-level analogue of Section 5 of the FTC Act, and they are the most broadly applicable state law affecting affiliates.
What UDAP statutes prohibit
Although the wording varies by state, these laws generally prohibit unfair or deceptive conduct in trade or commerce. An undisclosed material connection — an affiliate earning a commission on a recommendation the audience believes is independent — is exactly the kind of deception these statutes reach. Many state courts and attorneys general look to FTC interpretations, including the Endorsement Guides, when applying their own UDAP laws.
Who can enforce them
- State attorneys general can investigate and sue, often seeking injunctions, restitution, and civil penalties that vary by state.
- Private plaintiffs can sue under many states’ UDAP laws, and some provide for statutory damages, attorney’s fees, or multiplied (for example, treble) damages — which is what makes them a magnet for class actions.
The private-lawsuit risk
Unlike the FTC Act, which has no private right of action, many state UDAP statutes let consumers sue directly. Combined with attorney-fee and multiple-damages provisions, that makes state law a practical enforcement route against deceptive affiliate practices — sometimes a greater day-to-day risk than federal enforcement.
What this means for affiliates
The practical effect is reassuring in one sense: if you satisfy the federal clear-and-conspicuous standard and keep your reviews honest, you are simultaneously meeting the core requirement of every state’s UDAP law, because they target the same underlying deception. The compliance you build for the FTC does double duty across all fifty states.
Beyond deception generally, specific state statutes add particular requirements — on data privacy and on automatic renewal — covered on their own pages.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.