Most organizations treat a data breach as a security incident with legal consequences. That is correct as far as it goes, and it routes the response to information security, outside counsel, and the notification obligations under state law.
What that routing frequently misses is that the marketing department may have created a separate and independent violation months earlier, in copy nobody reviewed as a legal claim. The mechanism is straightforward and it has been the FTC’s most consistent data security theory for years: if a company represented that it protected consumer data in a particular way, and it did not, that is a deceptive practice under Section 5 of the FTC Act — regardless of the breach.
The distinction that makes this a marketing problem rather than a security one is that the deception prong applies even without demonstrated consumer harm. The violation is the misrepresentation. The breach is merely how it was discovered.
Where the Claims Actually Live
The representations that create exposure are rarely in a document anyone thinks of as a marketing asset. In practice they accumulate in five places.
The privacy policy. If it makes security representations — “we take reasonable measures to protect your data,” “your information is encrypted” — those representations must be accurate. The FTC has repeatedly pursued companies whose stated security posture was materially inconsistent with their actual practices. Privacy policies are usually drafted once, by counsel, and then never revisited as the technical reality drifts away from them.
Trust and security pages. These are marketing assets, written by marketing, and they tend to be the most specific and therefore the most dangerous. “Bank-level encryption,” “SOC 2 compliant,” “your data never leaves our infrastructure” are all checkable claims.
Sales collateral and security questionnaires. In B2B contexts, the security questionnaire response is a representation. It is also frequently completed by someone in sales working from a template that predates the current architecture.
Advertising and landing-page copy. Short-form claims — “secure,” “private,” “protected” — carry meaning to a reasonable consumer, and the FTC evaluates the net impression rather than the literal wording.
Certification and badge imagery. A displayed compliance badge is a claim about a current state. Badges outlive audits routinely.
The Pattern in Recent Enforcement
The FTC’s 2026 posture has been characterized as intensified enforcement on a familiar set of issues — subscription and negative-option marketing, “Made in USA” claims, children’s data privacy, and hidden fees — with a broader emphasis on consumer clarity and transparency. Data security representations sit squarely inside that emphasis, and the agency’s disposition volume is substantial: it closed more than 4,000 Title II and Title III enforcement actions in fiscal 2024 across its ADA work alone, which is a useful indicator of institutional capacity rather than of appetite in this specific area.
The illustrative case is the consent order against Illusory Systems, operating as Nomad, where the allegation was that failure to implement basic security measures allowed attackers to access and siphon $186 million in customer funds. The counts included both deceptive and unfair practices tied to the company’s data security representations — not merely to the security failure itself. Enforcement in 2026 has also reached privacy practices in consumer health, with an action against Hims & Hers in July 2026.
The through-line is that the representation is the hook. A company with weak security and no claims about it has a security problem. A company with weak security and marketing that says otherwise has a security problem and an FTC problem.
The Practical Review
The remediation is unglamorous and consists mostly of making one team read another team’s output.
Inventory every security representation the organization has published. This is the step that gets skipped and it is the whole exercise. It includes the privacy policy, the trust page, the last three years of sales collateral, the security questionnaire template, the marketing site, and any badge or certification imagery. Most organizations discover claims nobody currently working there wrote.
Have security — not legal, and not marketing — verify each claim as a statement of current fact. Legal can assess whether a claim is actionable; only engineering can say whether it is true. “We encrypt data at rest” needs an answer about which data, in which systems, with what exceptions.
Fix the drift. The most common finding is not a lie but an expiry: a claim that was accurate when written and became inaccurate through a migration, an acquisition, or a vendor change. That is still a misrepresentation.
Prefer qualified specificity to unqualified superlatives. “Customer payment data is encrypted at rest using AES-256” is verifiable and defensible. “Bank-level security” is neither, means nothing technically, and is exactly the kind of net-impression claim that reads as a promise to a consumer.
Put security claims into the marketing approval workflow permanently. A one-time audit fixes the current state. Only a standing review keeps it fixed, and security claims are the category most likely to be added by a well-meaning copywriter reaching for reassurance.
What to Do in the First Week After a Breach
If an incident occurs, the marketing-claims review belongs in the first week, not the post-mortem. Pull the published representations as they existed during the exposure window — including archived versions, because regulators will — and get an honest internal read on whether any of them was inaccurate.
Do this before the notification language is drafted, because the notification itself is a representation and it will be read against the earlier ones. A notice that describes a security posture inconsistent with what the company was marketing does not conceal the gap; it documents it.
The department that writes about security is making claims on the record whether or not it thinks of them that way. Treating that copy with the same review discipline as a pricing claim or an earnings statement is the entire fix, and it costs almost nothing before an incident.