Meghan Stoppel

Welcome to the second season of State AG Pulse. In this season, we will be releasing a new podcast episode every two weeks. In addition to providing a deep dive into those headlines that showcase the enormous power and broad authority of state attorneys general, we’ll be talking with new AGs about their transition into office and their priorities. Like last season, we’ll leverage our decades of experience to provide our listeners with insight and perspective to help business leaders better understand and successfully work with State AGs. Listen for new voices as co-chairs Bernie Nash and Lori Kalani share the host mic with other members of Cozen O’Connor’s State AG Group. So now let’s jump right in to this week’s episode.

Lori Kalani

Welcome back to State AG Pulse. I’m Lori Kalani. I’m the co-chair of Cozen O’Connor’s State AG Practice, and I’m excited to be hosting today’s episode where we’re going to discuss hot topics in consumer protection AI and ORC. I’m thrilled to have two of my outstanding law partners joining me. I’m joined by Siran Faulders and Maria Heard today. Hello, Siran and Maria.

Siran Faulders

Good morning. A pleasure to be here.

Maria Colsey Heard

Hi, Lori. Happy to be here again.

Lori Kalani

Well, this should be an exciting episode. It reminds me of when I worked at the FCC and we always talked in acronyms. So here we are, right back full circle with AI and ORC. So a lot to say, so let’s get started. Siran, I’ll start by asking you exactly what ORC is and what it is not.

Siran Faulders

Well, Lori, I can recall when the topic first began to come to the attention of the attorneys general. And frankly, there were some who were really unfamiliar with what it meant, and not only the acronym, but just what Organized Retail Crime meant. And they were frankly skeptical that ORC was an issue in their state, but that has really changed now. So what exactly is ORC? It can generally be described as systemic large scale theft of retail goods sold for a financial gain to wholesalers, retailers, or individual consumers for a fraction of the retail cost. More recently, ORC fences are using peer-to-peer venues in which buyers and sellers directly engage with one another.

Now, I would be remiss if I didn’t say here that criminals of course can steal from retailers in a variety of ways that often affect their bottom line. Cargo theft is on the rise and even return fraud. But here what makes it different from the typical shoplifter who is stealing for personal consumption, most often spontaneously with no premeditation, with ORC, what you have is a division of labor, so to speak. First, you have the people who actually steal the goods, but even that is much more sophisticated than it used to be. These people study the store layout, they know where the security cameras are, they know the anti-theft mechanisms that are used, and sometimes they rely on insiders for information and help.

But besides the actual theft, you have a much more sophisticated operation, inventory management, marketing, sales fulfillment, money laundering, and centralized coordination among the bad guys.

Lori Kalani

Well, it’s interesting when I see some of these press releases from AGs, where they’ve made a big bust of an organized retail crime ring, they’re busting in on them and they’re not necessarily finding goods, but they’re finding guns and in some cases drugs, and a whole lot of cash. So I tend to think of it as a real enterprise, a criminal enterprise, of which one piece happens to be this Organized Retail Crime.

Maria Colsey Heard

Yeah, Lori, that makes me think of something. I mean, it really does have so many tentacles. Human trafficking comes into play too. The organized crime rings, the leaders of such rings, are pulling in people who are vulnerable to act as the shoplifters.

Siran Faulders

They pay them nothing to actually do the stealing, and then of course there is this far more sophisticated network that makes lots of money doing what it is they do once they get the goods.

Lori Kalani

Yeah, all really good points. It’s like the ring of crime. I think every single AG conference or meeting we go to has some component of a discussion about ORC. So there’s a real interest by the AGs in general, I think, to learn and discuss these things.

Siran Faulders

With the advent of the internet, new possibilities have opened up. And of course, with those new possibilities, there is a greater revenue stream that has made this much more of an issue.

Lori Kalani

So what’s your view, Siran, on why you think we’re seeing this increased focus by state AGs? I mean, there’s a lot of law enforcement players out there who could be focusing on this, and maybe they are, but I’d love your opinion on that.

Siran Faulders

You have Homeland Security focusing on it, you’ve got the FBI, and you have state AGs working hand in hand with law enforcement across the board, both state and federal. And also one of the things that I think has been unique here is you see public-private partnerships here, you see the AGs working with some of these retailers to take down the criminals. While most of the crimes frankly are non-violent, I think one of the reasons that you’ve seen an increased focus is, and there’s a real tick up in the smash and grab. I haven’t seen the  statistics yet, but retailers are traditionally reporting increases in over %.

Lori Kalani

Well, I was in San Francisco and went into a large department store and couldn’t figure out why they had so much security and why there were so many police officers. And it turns out they had just been victimized by one of these smash and grabs. And personally, for those who know me, I love to shop and these smash and grabs have ruined my shopping experience because I go to certain stores where they’re only letting in three people at a time, and you have to put your name on a list. So I like to shop and I don’t like lines, so it’s been a real bummer for me. So I’m ready to get all this solved so we can get back to the old-fashioned shopping way. So tell us a little bit more about what’s being done about it.

Siran Faulders

This is really largely one of the few bipartisan issues that lawmakers, both at the federal and state level, seem to agree on. So that’s the good news. You really have everyone working together on these issues. So just to talk for a few minutes about what’s going on, on the federal side, and then I’ll offer a few comments on the state side as well. At the end of , Congress passed what is called the INFORM Consumers Act, which stands for, and I’m going to read this, “The Integrity, Notification, and Fairness in Online Retail Marketplaces for Consumers” Act. So again, another one of those acronyms that we’re all learning about. The Act applies to what is called online marketplaces, and that’s defined as consumer-directed platforms that enable third-party sellers to engage in the sale, purchase, payment, storage, shipping, or delivery of a consumer product.

So basically INFORM, the Act, the federal Act, requires online marketplaces to collect, verify, and disclose certain information about high volume third-party sellers. And by high volume, the threshold isn’t particularly high. The threshold is  transactions a year with income of $,, so that captures a large number of online marketplaces. The information that online marketplaces must provide is bank account numbers, contact information, and provide government-issued identification. Plus the Act gives the state AGs and the FTC authority to enforce if online marketplaces have failed to collect and disclose this information. So AGs can come in and they can get injunctions, they can get civil penalties. So there is enforcement authority for both federal and state law enforcement.

The deadline for these requirements to go into effect is really right around the corner, June th in fact. As is often the case when there is a deadline for compliance, it is possible that the larger, more sophisticated entities will have the resources and the manpower to come into compliance more quickly than other similar marketplaces who might struggle to be INFORM-ready on day one. So we’ll have to see how that plays out, but the deadline is looming and I’m sure that online marketplaces are doing what they need to do to be in compliance by the th.

On the state side, just a few comments. As we’ve all noted, the AGs have been really active over the last two years. The Attorney General Alliance has set up a bipartisan working group that’s been in operation for a couple of years now. That group meets regularly and it includes private sector companies. You’ve got a real combination of folks taking this issue very seriously. And as we’ve all recognized, the Democrats and Republicans are agreeing alike that it’s a serious problem to be addressed. Well…

Lori Kalani

If I could just interrupt you, I think it’s a coordination issue too, because these consumer products that are stolen for resale, they don’t necessarily steal them in state X and sell them in state X. And as you’ve said, they’re sold online in many cases. And so I think there’s been a real emphasis amongst the states to coordinate because it’s not just coordination between local law enforcement and federal law enforcement, and state law enforcement, but also over state lines.

Maria Colsey Heard

I also think it’s a place for national organizations, national associations to get involved. I’m sure they’re very instrumental in helping businesses. Especially if you have a small local business, they need to connect with somebody who can speak to these regulators and deal with this across the country.

Siran Faulders

Well, that’s an excellent point, Maria. It really is something that associations are taking an interest in, writing articles, teaming up with retailers, and also the online marketplace to understand the sophistication of these enterprises. So excellent point. Across the board, you’re seeing interest and people really working together, which is I think what makes this a unique issue since we see on so many occasions there are areas where they’re not working together.

Just a quick comment. Both red and blue states have passed their own INFORM laws in the last six months. You’ve seen  states that have passed legislation, I won’t name them all. And even now, another example is that the Kansas Attorney General is seeking legislation in this area and specifically seeking authority to take on prosecution of ORC. Washington AG, AG Ferguson, has created a -person ORC unit to take on the issue. And I really wanted to just give a personal shout out to Kwame Raoul because he really was, at least my experience going back to several years ago, he was one of the first AGs to highlight and take on this issue in a big way.

And he really has a roadshow, he brings folks from his office that are so knowledgeable on the topic, he created the state’s first organized retail crime task force teaming up with law enforcement partners to investigate these smash-and-grab crimes. And just over the last couple of years, his office has recovered thousands of dollars of stolen goods and storage units where these guys keep them in the Chicago area.

Lori Kalani

Let’s talk about the future. What’s coming next or where do we think this is going now that we have these various pieces of legislation in place?

Siran Faulders

What I think you can expect, I think we can expect more states to introduce and debate the need for a state-level INFORM Acts. It’s questionable whether a state AG can exercise authority that doesn’t come from state law. So you may have some state AGs saying, “We can’t enforce this unless we have a state law in place.” So that’s a possible, a good reason why some states might say that the federal INFORM Act is enough. And some AGs are trying to address the problem using their existing prosecution tools.

Lori Kalani

Yeah, I agree with that and I think it’s a worthwhile effort to make sure that when we as consumers are purchasing something, that we’re not purchasing stolen goods. So I mean, guess as a consumer, if I see something that’s a fraction of the price of retail, I assume it’s stolen or it’s counterfeit. So hopefully they can continue to work to eradicate that.

So let’s turn to AI, our other acronym of the day, Artificial Intelligence. And it’s interesting, the first time I heard about this in the context of AGs was a few years ago, the Washington D.C. attorney general convened a group to talk about the possible discriminatory effects on consumers in the financial industry. What is AI? So Maria, you want to take that one?

Maria Colsey Heard

Yes, I will. Every time I hear AI, I think, “Gosh, think about those  science fiction movies and we have robots who could think like humans and act like humans and start taking over the world.” Are we there yet? No, but there are concerns with AI. So from a purely objective IT perspective, Artificial Intelligence, AI, is a computer system that can perform tasks that typically a human would perform, like seeing or hearing, speaking, and other human brain functions like decision-making. And I think it’s the decision-making part of this that has risen to the top of people’s focus and concern. They use algorithms. What are algorithms? I need to think about things in very simple terms. And it is a list of instructions for specific actions, step by step, to get to the answer to a question or solve a problem.

Seems very broad. It is very broad. I want to quote the FTC because I think they put it very well and it helps us shift to the regulation side of this, recently in a blog they said AI is an ambiguous term with many possible definitions, but one thing is for sure, it’s a marketing term. And marketing claims are traditional areas for state AG and FTC investigation and oversight, so AI is a new focus in a traditional area for the AGs and the FTC.

It is a developing area, which is why we’re talking about it. Recently a bill was introduced in the US Congress to establish a federal commission that would regulate companies that offer, and this is a quote, “Content primarily generated by algorithmic processes.” Not very focused, and one of the things that some people are questioning about creating a new commission is we already have regulators in the space. You have the AGs, you have the FTC, you have the DOJ, and others who can investigate and take other actions against companies and organizations for marketing claims, privacy violations, and other consumer-facing concerns.

And then you have state legislatures who already have passed laws to regulate some aspects of AI. For example, there are state laws which require online businesses to disclose to the consumer when they’re using an AI-powered chatting function. And there are disclosure laws in some states, privacy laws themselves. The California Consumer Protection Act, which is, we’ve talked about before, very widely known for many of its privacy focuses and other state laws that are similar, they have a provision, California does, in the CCPA, where organizations, and I keep saying organizations because this is not just for profit, this is also nonprofit, right? So I use the word organizations sometimes instead of companies. They have to allow consumers to opt out of the organizations’ use of AI-powered decision-making methods.

So there are many good things that AI can do, and the regulators are trying to balance the good with what they see as a potential marketing, privacy, and other issues of concern.

Lori Kalani

And civil rights too, right?

Maria Colsey Heard

Absolutely, civil rights, you’ve raised the bias and discrimination issues, which are definitely at the forefront of many, the minds of many.

Lori Kalani

I think it was late last year, The White House put out what they called a blueprint for an AI bill of rights, and that had five principles and they were safe and effective systems, algorithmic discrimination protections, data privacy notice and explanation, and human alternatives, which would be the opt-out, right? So it seems to me a lot of that is already incorporated in some of the privacy laws that are out there. And every time I see the word opt-out, I think to myself, “So if I were applying for a loan and I opted out of the AI-powered decision-making methods, which companies are going to have to allow people to do, I just wonder how long it would take me to get an answer on my loan, which I now get in about  seconds.”

So I think there’s a real balance there and it’ll be interesting to see the way consumers react to that, whether people will use that opt-out method and wait around and hope that somebody answers them about their car loan by next year. So why are the AGs concerned about it beyond just the regular privacy legislation and regulation that’s out there now?

Maria Colsey Heard

Right. I think regulators, the AGs have said, I think we’re playing a little bit of catch up here with a rapidly progressing technology field. AI tools, they learn by being fed data. And so the output is only as good as the data that’s being put in. Is it reliable data? Was it reliable at one time, but it’s now outdated and not reliable anymore? Are the algorithms objective enough? Is there some bias that’s going to show by the way the algorithm was created. We’ve already raised the employment applications and New York requires that a bias audit of AI-assisted employment tools be done. And Illinois has a statute that restricts how AI can be used in these hiring application assessments. There has to be notice given to applicants that AI is being used, explain how it works, and then you have to get consent.

So there are things that the state legislatures with support of the attorney general in their state are doing to try to fight this garbage in, garbage out, and any biases. Another very big thing is AGs and federal agencies are focused on false and deceptive marketing claims for goods and services. They’re concerned at the marketing statements of companies and organizations referring to AI. They want to make sure they’re truthful and that they’re clear to the average consumer. So there is the risk that some advertisers will claim that AI powers their product, is part of their service, when it really isn’t.

You might think that’s straightforward like, “Well, of course just if it doesn’t have AI, don’t say it has AI,” but as the FTC and the AGs have recognized, it’s an ambiguous term. AI may mean different things to different people and there’s also a question about how far can you go in saying what your AI does when you say a service or a product is AI-powered, you may have some claims saying that it’s better than other companies’ services and products that are not AI-powered. And there what you need is substantiation. There needs to be support for those claims.

Lori Kalani

Otherwise you could be deceiving consumers, right?

Maria Colsey Heard

Right. I have an example that’s a good example. It’s the flip side of the concern that AI is going to use bias in order to reach discriminatory hiring decisions. You have a case study where a particular tool was used by a company, a publishing company, to write their job descriptions, write the posting that was going to be put into the paper or on online to try to get new applicants. They were able, by using this tool, to create a more inclusive job posting. And the results were that the percentage of women recruits went to % of the total pool. Previously women applicants were only %.

Siran Faulders

I think that is an excellent example of how AI was used to benefit women, used to be helpful in the employment setting. And I think that that explains a bit why the regulators have not really given much guidance to the industry as to how to use algorithms. I think they are more in a wait-and-see. Let’s see how this plays out.

Maria Colsey Heard

That’s a great point, Siran, and it also I think informs our listeners if you are a business that is using AI, you’re very versed in AI, if you have information that is going to help the AGs understand this and understand the benefits of it, this is a great area to go and start doing some education. While they’re waiting and seeing, they’re hearing from many in public interest groups and consumer groups and others, and you would want your voice to be heard too.

Lori Kalani

Yeah. And I think there’s an element of this that’s self-regulation. If you take some of these principles that even The White House put out that are pretty general and you stick to them and you have a privacy policy that is accurate, I think that those privacy policies going forward, as AI becomes more embedded in everyday businesses, I think the privacy policy of a company is going to be one of the first places to look and to revise and update to make sure it accounts for the business process in place today. I would advise companies to take a hard look at their privacy policy because short of having an AI policy that the government will maybe someday require of companies, I think the answers really lie in the privacy policy, making sure that that’s accounting for how data is collected and used with respect to that company.

Maria Colsey Heard

Absolutely. And I think as you have more of this technology, the type of data you need is not as apparent and there’s going to be issues about what kind of data are you collecting from a consumer and are you learning data as you go along that you’re adding into the tool, right? AI is supposed to learn and get better and get more sophisticated and more accurate, and what type of data is being collected in order to do that and how is it being stored, and how is it being protected? Those are all important issues.

Lori Kalani

Boy, it makes me wonder if the definition of PII, another acronym, Personally Identifiable Information, will change as time goes on with more data being collected on people.

Maria Colsey Heard

Right. And we’ve seen regulators, they’re concerned about things that identify somebody, but they’re also concerned about things that just would seem sensitive to a consumer. The small P, small I, personal information. And those types of things may come into play with AI.

Lori Kalani

So much good can come out of it, but I think it’s just all about monitoring your systems, disclosing, and keeping up with your disclosures, whether that’s in your privacy policy or otherwise.

Maria Colsey Heard

Yes. I mean, the healthcare area is such an important area. We want more integration among healthcare systems. You want to be able to go to your healthcare provider. The ultimate goal is for there to be a holistic system. You go to one healthcare provider and they have the records from another healthcare provider, and they get to see your entire health history, which will help them provide you with the best service.

Lori Kalani

My sense is that regulators and our regulators, meaning the ones we work around every day, the AGs, will be interested in all of these issues. We’ve seen it on the discrimination side with employment and financial services, but I think that it’s just going to expand from there.

Maria Colsey Heard

Yes. As I would say, my final pitch to the listeners who may have AI, know what it is, make sure you have support for any claims, make sure you are updating and revisiting your data policies.

Lori Kalani

Thank you for those parting words. Siran, I think we’re almost out of time. Any parting words from you?

Siran Faulders

Nothing, but appreciate the opportunity to chat with the audience today on two topics that will be under discussion by AGs and federal regulators, most certainly in the days ahead.

Lori Kalani

Thank you. So with that, I want to thank our listeners for tuning in and be sure to keep an eye out for our next episode of State AG Pulse. We’re going to have Charity Clark, Vermont’s Attorney General, joining us for that. And I’m sure you won’t want to miss hearing from General Clark, and I’m not going to put words in her mouth, but I’m sure that some of the topics she’ll talk about will be some of the things we’ve mentioned today. So tune in for that and thank you so much for listening.

Meghan Stoppel

You have been listening to State AG Pulse, brought to you by Cozen O’Connor’s State AG Group. Research for this podcast was provided by our associates, Ryan Bottegal, Hannah Cornett, Keturah Taylor, and Emily Yu, as well as our policy analyst, Elisabeth Hill Hodish. If you enjoyed this week’s episode, please leave us a five-star rating and review. This will help our visibility and will allow other listeners to learn about the podcast. And of course, please tune in again in two weeks for our next episode.