Ashley L. Taylor Jr., a partner with Troutman Pepper specializing in Consumer Financial Services, joins IMS Insights Podcast to share some of his decades-long experience with state attorneys general and consumer protection issues. He discusses the roles that attorney generals have historically played in both regulating and enforcing consumer protection issues, how regulatory and enforcement actions have been affected by the COVID-19 pandemic, and how the legal industry has been innovating to keep pace with the emerging challenges in a post-pandemic world.

Teresa Barber: Hi Ashley, welcome. Thank you so much for joining us today.

Ashley L. Taylor Jr.: Thanks for having me.

Barber: I wanted to just pick your brain a little bit and have you break it down to the basics for us. Could you explain exactly what a state attorney is? What they do?

Taylor: Sure. A state attorney general is the primary and lead attorney for a state. Each state has an attorney general. Some are elected - indeed, most are elected. About forty-five are elected. There are a number that are appointed by the Supreme Court in each state. They often are the first line of defense, or the first contact that a consumer will make when they have a consumer complaint about a product. Historically, most AGs have been involved in consumer protection claims. They also serve in most states as the appellate division for criminal prosecutions. When you see high-profile cases that are prosecuted by the local prosecutor, when those matters are appealed, a state attorney general will often serve as the defense counsel - or the prosecutor, rather - for all appeals.

Barber: Ashley, why should that matter for in-house counsel or other corporate leaders?

Taylor: Well, for companies, any company that interacts with consumers, or that puts a product in the marketplace, or makes representations to consumers, needs to be concerned about state attorneys general activity because one of the primary roles that a state AG plays relates to consumer protection. The phrase you will hear is “unfair and deceptive trade practices;” it’s often the phrase you will use. And that has historically been the area where a state AG has been most active. Again, that cuts across industries, it cuts across technology. Companies should always evaluate the enforcement history of a state AG as they develop their compliance programs.

Barber: Ashley, this is something you watch every day, fairly consistently. Have you noticed any state attorney general rulings and behavior in recent years? How does this stack up to the historical role that state AGs have played in the past?

Taylor: Well, the best way to answer that question, Teresa, is to really take a step back and talk about the historical role an AG plays, and then talk about the modern attorney general. What is the historical attorney general? Well, if you go back fifty years and you were to pull a profile of state attorneys general, the typical profile would be someone who is at the end of a very distinguished legal career, and they (then) run for the office or are appointed as a capstone to their career. They'll be in their late fifties, early sixties — or, you'll find someone who approaches the job with the goal of being a lifelong attorney general. They'll spend three or four election cycles in the office. That is a historical role. The modern AG is a different blend. It's equal part(s) lawyer, policymaker, and politician. I don't mean that in any negative sense at all. These are elected officials — they always have been — but the modern AG is often someone whose political profile is on the rise, as opposed to being at the end of their political career.

Taylor: If you were to look at the profile of today's attorney general, it's often someone who spent maybe three or four years in a House of Representatives for their state, or in their State Senate, or as (a) local prosecutor. The attorney general's office is a stepping-stone to other political offices. You'll see governors who are former AGs. You'll see senators who are former AGs. A senator from Texas is a former attorney general of Texas. The current attorney general of Kansas has announced his (intention to) run for governor. These are oftentimes stepping-stones, and it makes sense. The attorney general's office, unlike someone in the state legislature who has to work through a committee and have a governor sign his bill, the attorney general — (and) we can talk about this later — has a lot of autonomy under their constitutional authority. They can initiate lawsuits, open investigations, and they can do so without going to any committee, or without having to pass a different bill; they have what is called statutory and plenary authority that they routinely exercise.

Barber: Interesting. Can you talk to us a little bit about the seminal moment for state AGs and enforcement practices, and why you'd consider it that?

Taylor: When I think about the modern attorney general, I think about one particular moment, and that is the National Tobacco Settlement (Tobacco Master Settlement Agreement [TMSA]). As folks may remember, there were a series of lawsuits filed by state AGs against the major tobacco companies in the early ’90s. There was a lawsuit filed by Texas, by Florida, and Minnesota. In early ’98, there was a bill in Congress and the Senate Finance Committee or Commerce Committee, led by then-Chairman McCain, where he attempted to create a National Tobacco Settlement complete with a large trust fund, et cetera. That bill did not pass. What everyone thought would happen after that federal bill collapsed, they all assumed that the states would just have a series of lawsuits against the tobacco companies; but that's not actually what happened. What happened is the state AGs came together and they entered into a National Tobacco Settlement.

Taylor: They all didn't file separate lawsuits. They actually came together and worked together in a way that produced this national settlement. From my perspective, both my practice perspective, as someone who fashions themselves to be a political observer at some level and someone who's just interested in the intersection of politics, policy, and the practice of law, you saw what, to me, appeared to be a seminal moment — states coming together, learning that their collective power carries great weight, and that they can often leverage that collective power in a way to strengthen their position in a very different way than (if they were) acting individually. That really was a seminal moment.

Barber: Very interesting. Could you bring it back home for corporate leaders (and) for companies? You've been observing some trends. Can you talk to us a little bit about the role of these multi-state AG actions and amicus briefs? What should firms, what should companies, be watching?

Taylor: Companies will now be familiar with the headlines of a multi-state settlement for millions of dollars against a company. Those are recent headlines. Again, the first big headline was the tobacco headline in ’98, but the model of states working together is what corporate leaders should be aware of. This often happens in areas where policymakers may be frustrated with what they perceive to be the slow pace of legislation in a particular area. If you track enforcement actions, you can often trace a series of enforcement actions’ policy changes — and oftentimes, you will have enforcement actions that are precipitated by legislative frustration. You'll see a bill introduced in the state house, that bill (will be) rejected, (and) you will often see enforcement actions around that same gray area or statutory question. In fact, what you have is a series of enforcement actions that actually create a policy or the standard of practice in an industry.

Taylor: Why should a company care about a state AG, or care about the collective action? If you're a company and you're focused on compliance, you're focused on identifying future risk. You should focus on monitoring those collective actions (and) monitoring the enforcement environment, because it helps you identify the risk — and that's particularly true in areas like privacy, which we can talk about at some point. But it's important if you are a company and you're looking around the corner to identify areas of potential risk and exposure. You can do so by learning from the experiences of other companies; you don't have to necessarily be burned by the hot stove yourself. You can watch someone else be burned, read the settlement agreement, understand what precipitated the action, and take measures to protect yourself.

Barber: Yeah. Interesting — a lot to watch, Ashley. I also want to talk about this very unique moment that we're in right now, given the pandemic. (There’s) significant uncertainty for so many companies and consumer behavior — even market and industry behavior, at times. The way people are buying things (and) interacting (with)companies — quite a bit is changing. We're calling it a new normal, a lot of adaptation. We've also welcomed in a brand-new administration and a fresh cabinet. Are there any indications for in-house counsel or corporate leaders to watch right now for how the new administration may handle regulatory enforcement and oversight?

Taylor: I think so. One of the first things that we started to notice in the language that was being used is they are reviving the focus on the disparate impact on certain policies of business practices as it pertains to minorities, and other "vulnerable" populations. That's a term of art from the case law. I think that's going to be a driving force in a lot of enforcement action and in various areas. I also think the entire world of privacy is an area that will receive a renewed area of focus for this administration. The vice president when she was — and this goes back to one of my earlier points — when she was attorney general of California, she very much focused on privacy as an area of consumer protection. She led a number of very significant cases in that regard.

Taylor: We are closely monitoring any potential development of a federal privacy act. Some have been introduced, but we haven't seen one that has gained legs and/or momentum as (of) yet. But that's something where we're all watching very closely. The other thing we're watching, relative to this new administration, is who is going to be the primary regulator of privacy? If I ask you that question now and you’re a company, your question is, ‘Okay, I want to comply with the privacy laws, where do I look?’ We see a sense of regulatory competition and/or tension between the Federal Trade Commission (FTC) and the states more generally. You have California having passed the CCPA, which includes a new administrative bureaucracy with rulemaking authority, and AG authority in California to both enforce and regulate the area of privacy through its traditional consumer protection statutory prism. But in addition to that, you have the new agency — you have a new bill here in Virginia which makes clear that it doesn't create a private cause of action, but it gives new teeth to the attorney general's office.

Taylor: It has a provision that requires the attorney general to give you an opportunity to cure a defect before they can perceive failure to comply with the law — not a defect, but a failure to comply with the law — before they can take any regulatory action. But again, you see developing throughout the states, like you did years ago in the area, Teresa, of breach notification statutes. If I take you back five or six years, when a company had a data breach, they would have to notify a number of states. Then you saw a series of state laws where there was a wave that went across the country, over a two or three year period, where all the states passed some version of their breach notification statute. You see a similar wave developing here (that) started in California with the CCPA. This year Virginia passed a statute. Oklahoma has a statute that is working its way through its general session now. You see this same policy, or the same wave developing this year. Not in the context of breach notification, since everyone has that, but in the enforcement action — primarily for state AGs in the area of data breaches.

Taylor: Again, in the absence of federal legislation. Those are the two items: disparate impact for vulnerable communities, and the privacy landscape more generally. The feds will be active — probably not by way of national legislation, but certainly through enforcement actions (and) policy statements of the Federal Trade Commission (FTC).

Barber: Yeah. Fascinating — and all that time, too, when so much has moved into a digital environment. I wanted to ask you a little bit about that and pick your brain. We were talking about the pandemic until a moment ago, and in so many ways, it forced the hand of innovation. Companies and firms are having to look to new ways to connect with customers (and) drive business — entirely new business models at times. Are there new approaches or innovations you're seeing that at this moment (appear) likely to invite regulatory scrutiny?

Taylor: I think so. I think this new time has exposed an area of the law that was always there, (but) it was disjointed — and that is how goods and services are defined in the context of what we have characterized as a hybrid transaction. What do I mean by that? If you have an internet (capable) device that has an operating software, you purchase the device, and it includes operating software. Well, the company that actually provides the technology for the operating software may be different than the company that provides you with the hard device. As soon as I say that, all of the listeners should be thinking of the many ways this occurs. It occurs with your home exercise equipment. It occurs (with)in the context of your car. The car manufacturer sells you the car, but there may be some technology within the car that you've paid for, but it's actually controlled by a third party.

Taylor: Another great example is home security. You may purchase your home security hardware device from one company, but the software — how it connects to the internet — is (controlled by) another company. They come bundled initially. But what happens if the company that provides the software goes out of business? So, you purchase a bike — and I won't use a brand name, but just assume there's a bike out there —that has a connection to the internet and certain technology. Well, what happens if the company that facilitates the technology and the connection to the internet is different than the company that provides the bike? As a consumer, you purchase both, and you in your mind don't distinguish what is a good and what is a service. You just purchased the device because you want the bike, or you want the car, or you want the home security system.

Taylor: Well, states are different. Some call the software a good, some call it a service. The laws are (all) across the map. What happens if the device simply no longer performs — what's a consumer(‘s means of) redress? Or, what happens if it can be modified by the manufacturer, or there are upgrades made available, (and) you have to pay more for the upgrade, but that wasn't clear when you purchased the base device? What happens if the company simply goes out of business? All of these are questions that are being raised by virtue of the shift to this new environment. They've always been out there. We've been writing about it for a couple of years, but we can at least sense that next wave coming. Not because, from our perspective, any company is doing anything wrong. But with the migration to at-home services, bundling of these services, and state laws failing to catch up, you have this open question that we believe the regulators are starting to focus on — and it's arising in the context again of consumer questions and/or complaints.

Barber: Sure, fascinating. You think (about it, and) many years ago we had a distinct fax machine, a distinct telephone, a distinct laundry, washing machine. Everything (involves a) lot of innovation.

Taylor: Right. Some of these involve a company locking up the technology so a consumer doesn't have the right to go in and upgrade it themselves — even when they could. There are instances where a consumer says, “Well, I don't need you to upgrade, I can go to a third party and upgrade.” And then the manufacturer says, “Wait a minute, even though you purchased the hardware, I didn't give you the right to go into the software to institute an upgrade.” It creates a series of legal questions (where) ultimately, going back to one of my earlier points, we believe the contours of the law will not be outlined by a legislative fix. It's happening too quickly. If it's more likely to be defined by (a) series of policy statements and/or enforcement actions or settlements for consumers. Companies need to track that and develop their compliance protocols accordingly.

Barber: Very interesting, Ashley. At the same time, how are you doing? How is this rapid change in technology changing your own practice? What are you seeing?

Taylor: Well, at a very human level, it’s caused me to go into my basement for six months. We all had to adjust in some way, but that was an interesting human experiment. The impact of being in your basement all day, alone, when you're used to interacting with colleagues and trying to find a way to be collaborative, creative, to problem solve in a team context — but to do so from your basement. I think it was a struggle for everyone, and I don't think I was any different in that regard, but you have to adapt. Consumers adapted immediately. We were wondering as a regulatory group, how our customers — or our clients, rather — would react. And how their customers would react. We were shocked with the speed of customer, or consumer, adaptation.

Taylor: Our clients adapted very fast. And you saw that in the(way that) — we thought, frankly, we were all anticipating just a drop in the economy. There was obviously a bump, but there was a pretty swift recovery. But we've all just had to adapt, and the regulators have had to adapt, Teresa. They've adapted, in fact, in many ways. We have seen an efficient enforcement regime — much more efficient. Our sense is that there are a lot of people who have eliminated what may (have been) downtime in their office. We've seen an uptick in the enforcement actions, and we've seen the uptick in their due diligence as they kick the tires on companies — which has been a surprise to us.

Barber: It's a very interesting (topic). And then at the same time, I want to keep on the pandemic for a moment. The world’s bracing right now for full vaccine rollout, (with a) lot of contenders out there among vaccination options. (We’re) still considering (how to contend) with uncertainty and risks; there's emerging variations of the virus. We've been talking about this (and how) there's a new normal, at least for the time being — (the) behavior and standard processes across US courts, the litigation, community businesses — so many aspects of people's lives have had to adapt. You're talking about your own personal experiences. We've seen really interesting glimmers of innovation when you're talking about consumers. We thought we were going to see a flat line in the economy, but there were these new innovations emerging and increased efficiency (instead). But there is also risk, (or) potential risks, for companies and communities.

Barber: Looking ahead to a time when the direct threat of COVID-19 and hospital over-capacitation has been mitigated, are there any particular behavior shifts you expect are going to be sticky, and maybe persist?

Taylor: The first thing I would say is (that) when we return to "normal" — which is what you were referring to, right — what's going to happen in our legal world and the regulatory world? As soon as you return to normal, after every significant crisis, the regulators don't look forward — they look back. They look back and evaluate the behavior of companies during the crisis. You (can) already see, as we begin to shift to this new normal, this modified normal, you see regulators looking back to see what companies did to survive during the crisis. One of the best examples, I think, relates to a number of investigations that state AGs, in particular, have initiated relative to the hidden cost of COVID fees that were included in certain charges. Dentist’s offices, restaurants, and others (have) included $5 COVID fees or $1,200 COVID fees — often to cover PPE and cleaning, for example, at a dentist’s office.

Taylor: But those have all been challenged. You see this pendulum swing. You see companies looking to survive — and in this case, adding a charge that they believe is appropriate. You see the regulators saying, “Wait a minute, I don't know if that charge is valid. I don't know if that additional surcharge is appropriate. I don't know if you disclosed it properly.” You see a wave of these actions across the country. The return to normal may occur at the consumer level, but in the regulatory context, regulators will be looking back and judging the behavior of companies. That statement that you make in the middle of a crisis, that surcharge that you put on which feels appropriate in the context of a crisis, looks very different when everyone returns to normal.

Barber: When the dust settles.

Taylor: Then you have to explain it, and say, “Well, you need to understand, at the time, there was a lot of speed and need, and it felt...” And what feels right in the middle of a crisis — (well,) when you're judging it two years later, it's often difficult to explain that to a regulator. We're expecting — and already starting — to see a lot of that. Fortunately for companies, I'm in the business of defending what they've done. As companies are trying to move forward, the regulators are going to be focusing on what they did and the treatment of consumers, and that's what we tend to focus on.

Barber: Very interesting. The other thing that we've been contending with too, Ashley, are these remote hearings; we've even seen remote jury trials (and) remote depositions. Do you see any of this sticking around post-pandemic?

Taylor: We already do. We are — in a number of our cases — we are both in court, in actual litigation, and in enforcement investigations that are not in court, but are equally adversarial. We are negotiating rules for how you interview a witness remotely, who can be in the room, what could be said, and it's requiring us to negotiate all of those rules. We can already tell that some of those new protocols are going to stick. Maybe if you have five witnesses, maybe all five need not be taken in person, in terms of those interviews. Maybe two of the witnesses (out) of five can be done remotely. Once you have rules in place and people are comfortable with that, you can see that being used on a modified basis. I don't think, and I do not anticipate, a shifting completely to a remote world.

Taylor: I think particularly, given what we do, and that is the (goal) —for our clients, at least. We represent clients that are upstanding clients that are trying to comply with the law. We believe our clients are passionate and (can) convincingly share their stories. We want that personal interaction, if ever one of our company’s products or statements to consumers is (in) question. We want that personal representative to have that opportunity to convey things in person — but you can already tell the regulators are pushing back on the notion to have every one of those visits in person. I do think that's going to be a permanent change. I think from a court perspective, the matters we handle in court, I expect that to return to normal.

Taylor: I do. But in the more informal context of an investigation, I think — depending on the party’s comfort level with remote interviews — I think you will see more of it on a permanent basis.

Barber: Interesting. This is just interesting too, thinking about how, for law firms, for the legal industry, (that is) not always the most innovative sector. What have we learned in the last year?

Taylor: What we've learned, I think, as big law, is that we have to be flexible or we will die. You have to be flexible — and while traditionally, big law firms have not been the most adaptable institutions, nor have we been the first to innovate historically, I think we've done a fairly good job of responding to this new environment. I'm really proud to talk about what our team did, even before this crisis, to adapt to what we saw by way of the changing regulatory environment. I want to brag on the team a little bit. We have a nationally-ranked state attorneys general team. We are ranked by Chambers and others. We're clearly recognized as one of the one or two top firms in the country if you have a state attorney general matter. But more broadly, we have a regulatory team.

Taylor: Why is that distinction important? Because the matters that clients face, where they often find us because of our first-in-class state AG team, are matters that are often of interest to the FTC, or the Consumer Financial Protection Bureau (CFPB), or a State Banking Board, or a plaintiff's attorney. The ability to have a regulatory team that can adapt to the threat — whether the threat is presented through the state AGs, or the FTC, or the SEC — is an important aspect of the practice.

Taylor: Law firms, again, historically may have communicated with clients the way you communicate in law school. That is, I present an answer to my professor that gains me an “A,” and I present that same answer to a client — (but) it's not particularly useful. It may be “A” work in law school, but for a client-facing a practical problem, it's not particularly helpful. We shaped that, and we reshaped our regulatory team around clients' needs before the pandemic. Frankly, it's been particularly helpful in the pandemic because the clients were calling to say, “We have an issue.” They weren't calling with a question presented like a law school exam, Teresa. They would call and say, “We have an issue.” (And) we would say, “Okay, well, let's take your issue and let's look at it from the perspective of the regulatory environment generally.”

Taylor: That'll mean one thing if you're in the food industry, something else if you sell a consumer product that's a financial services product, something else if it's an advertising question, but the issue arises in a regulatory ecosystem. It doesn't present like a law school question, and so clients want to know: is this product being presented to consumers in a way that's problematic? And we say, “Well, there is a concern raised by state AGs, but there's also a concern raised by the Federal Trade Commission (FTC). This has also been an issue that has been discussed by the Consumer Financial Protection Bureau (CFPB).

Taylor: This is also an issue that has been the target of class action lawsuits. Here is how they have been addressed. It's also been an issue raised by a State Banking Commissioner or a State Licensing Board. Having that holistic conversation for us is something we started years ago. What we found is that clients have truly appreciated that approach in this pandemic, because when the questions were coming, they were coming fast — and they were messy questions. They weren't tidy questions like you're presented in law school. They're questions that are practical, and they want to know what all of the regulatory concerns are.

Barber: Yeah, phenomenal. It sounds like a very clear view of the context out there, at a time where you might not even be able to define what that question is.

Taylor: Think about what you just said, Teresa. If you're a client and you sell a product, or you're introducing your product, you don't know where those concerns may come from you. You call someone, and you expect someone in my position to identify the areas of concern. You don't call me and say, "I've looked at a statute. It looks like this statute is on point, what do you think?" You call with a much more general question. And so, again, (that’s the benefit of) that holistic approach that's more practical (and) legally sound, but practically useful. That’s what we have focused on, and I think that has found great value in the legal marketplace over the past year.