Photo of Timothy A. Butler

Tim Butler helps companies thrive by developing tailored strategies to address their regulatory compliance challenges and vigorously defending them in government enforcement actions and bet-the-company lawsuits.

A former prosecuting attorney for the Federal Trade Commission (FTC) and former senior official in the Georgia Attorney General’s Office, Tim has led the defense of dozens of government investigations and enforcement actions brought by the FTC, the Consumer Financial Protection Bureau (CFPB), and the various state attorneys general. Tim also regularly defends clients in bet-the-company lawsuits, including complex business disputes and consumer class actions alleging privacy, false advertising, and unfair or deceptive business practice claims.

Tim is an experienced guide for companies struggling with regulatory complexity. He offers clear advice that helps his clients meet the demands of the ever-growing set of laws and regulations governing data privacy and cybersecurity, advertising and marketing practices, and consumer financial products and services. Clients rely on Tim’s business-minded and practical strategies to address their most difficult regulatory compliance challenges.

A graduate of the University of Chicago and Stanford Law School, Tim is a prolific author and regularly speaks to industry and trade groups about the evolving privacy landscape, about cutting-edge issues affecting payments and fintech companies, and about developments at the FTC, the CFPB, and within the state attorneys general community.

The Federal Trade Commission’s Rule on Unfair or Deceptive Fees, sometimes called the “Junk Fees Rule,” took effect on May 12, 2025. In advance of that effective date, the FTC published Frequently Asked Questions (FAQs) to provide guidance to consumers and businesses regarding the Rule.…

Continue Reading FTC Issues FAQs on ‘Junk Fees’ Rule

On April 30, 2025, the Consumer Financial Protection Bureau (CFPB) announced that it “will not prioritize enforcement or supervision actions” related to obligations imposed by its Small Business Lending Rule (under Regulation B) against entities not covered by the Fifth Circuit Court of Appeals’ stay in Texas Bankers Association v. CFPB, No. 24-40705.…

Continue Reading CFPB Will Not Enforce Small Business Lending Rule

On March 27, 2025, the Federal Trade Commission (FTC) filed a lawsuit and proposed settlement order resolving claims against Cleo AI, a fintech that operates a personal finance mobile banking application through which it offers consumers instant or same-day cash advances. The FTC alleges that Cleo deceived consumers about how much money they could get and how fast that money could be available, and that Cleo made it difficult for consumers to cancel its subscription service.…

Continue Reading FTC Alleges Fintech Cleo AI Deceived Consumers

On Feb. 11, 2025, President Trump nominated Jonathan McKernan to be the next director of the Consumer Financial Protection Bureau (CFPB). If confirmed by the Senate, McKernan would replace Russell Vought, who President Trump designated as acting director of the CFPB on Feb. 7, 2025, a day after Vought was confirmed as the director of…

On Nov. 6, 2024, the Federal Trade Commission (FTC) released an administrative complaint and accepted a proposed consent order resolving claims against GGL Projects, Inc., an AI-enabled customer review platform that does business as Sitejabber. The FTC alleges that Sitejabber provides its ecommerce clients with the ability to (a) collect ratings and reviews from consumers…

On Nov. 18, 2024, the Federal Deposit Insurance Corporation (FDIC) announced a 45-day extension to the public comment period for its proposed rule making (Proposed Rule) that would establish new recordkeeping requirements and related compliance obligations for insured depository institutions that offer certain “custodial deposit accounts with transactional features.”

As we detailed in a prior…

On Nov. 12, 2024, the Consumer Financial Protection Bureau (CFPB) released a report examining federal and state privacy protections for consumers’ financial data. In the report, the CFPB “critiques” the privacy protections available under the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA), asserting that the federal framework has “limitations.” The CFPB then…

On Nov. 5, 2024, the Federal Trade Commission (FTC) filed a lawsuit against Dave, Inc., a U.S. fintech company that offers short-term cash advances through a mobile banking application. The FTC alleges that Dave uses misleading marketing to deceive consumers about the amount of its cash advances, charges consumers undisclosed fees, and charges so-called “tips”…

On Oct. 22, 2024, the CFPB issued a final rule that will require covered financial institutions to provide consumers and authorized third parties with access and portability options for their financial data. The CFPB’s final rule, called the “Personal Financial Data Rights Rule,” implements Section 1033 of Title X of the Dodd-Frank Act, a to-date…