On May 21, 2025, the Federal Trade Commission (FTC) finalized its order with GoDaddy over allegations that GoDaddy “failed to implement standard data security tools and practices to protect customers’ websites and data.” In a Complaint filed against GoDaddy in January 2025, the FTC alleged that the company had “failed to implement reasonable and appropriate security measures to protect and monitor its website-hosting environments for security threats, and misled customers about the extent of its data security protections on its website hosting services.”

The allegations against GoDaddy include not implementing multi-factor authentication, monitoring for security threats, and securing connections to consumer data. As a result, GoDaddy suffered several data breaches, which “allowed bad actors to gain unauthorized access to customers’ websites and data.” In addition, the FTC alleged that GoDaddy “deceived” users about its data security practices and compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.

Pursuant to the order, GoDaddy is:

• Prohibited from making misrepresentations about its security and the extent to which it complies with any privacy or security program sponsored by a government, self-regulatory, or standard-setting organization;
• Required to establish and implement a comprehensive information-security program that protects the security, confidentiality, and integrity of its website-hosting services; and
• Required to hire an independent third-party assessor to conduct reviews of its information-security program.

The FTC voted unanimously, 3-0, to finalize the order. The order emphasizes the FTC’s continued focus on data security and companies’ representations of data security measures to consumers. Therefore, companies may wish to reassess and update data security practices to confirm that they are commercially reasonable and consistent with their assertions to the public.