This article is closed for comments.
I spit on sick dog prophet mohammed. allah is a demon.
I spit on sick dog prophet mohammed. allah is a demon.
Otherwise you get yourself into serious trouble. Green Card gives you access to every breast. Without it go look for Sister Tina, 50Yr Old Akua Maami or Nima born Amina in the Bronx to fondle their breast.. The worst you can ...
read full comment
Otherwise you get yourself into serious trouble. Green Card gives you access to every breast. Without it go look for Sister Tina, 50Yr Old Akua Maami or Nima born Amina in the Bronx to fondle their breast.. The worst you can get is "Kofi djai rough nu'. Adern we dimi saa ma bre' Case closed. Cest finis!
Keep away from the Akta sounding names " Minishiqua, Scincilatiso, and Dishinquata'. You asking for loads of trouble and future suicidal thoights!
Waooow what a touching story; you're a strong man uncle Sam. What a brave man, I'm really proud of you. You'll be very fine by God's grace. Something good is coming your way soon. You're indeed a real and humble man. You have ...
read full comment
Waooow what a touching story; you're a strong man uncle Sam. What a brave man, I'm really proud of you. You'll be very fine by God's grace. Something good is coming your way soon. You're indeed a real and humble man. You have my respect
He claims to be "an expert in playing golf". He must have joined the wrong crowd. He doesn't look like a "golf man" to me. "About ten police vans stormed my house". If that is true then the guy must have done something mu ...
read full comment
He claims to be "an expert in playing golf". He must have joined the wrong crowd. He doesn't look like a "golf man" to me. "About ten police vans stormed my house". If that is true then the guy must have done something much more serious than he is narrating.
Just don't go close to alcohol again, it's part of your downfall. Alcoholism will ruin your life.
Just don't go close to alcohol again, it's part of your downfall. Alcoholism will ruin your life.
Alcohol makes you insane. That is why Muslims don't like it.
Alcohol makes you insane. That is why Muslims don't like it.
!!!!!!! Hot girls are waiting for you on ---- www.Hot4.eu
!!!!!!! Hot girls are waiting for you on ---- www.Hot4.eu
Ogyakrom boy, you went to America to do your Masters and you were hanging out with golfers. The ethics are different in those circles. Perhaps she saw you as foreigner and just wanted to make you feel at home, so she went o ...
read full comment
Ogyakrom boy, you went to America to do your Masters and you were hanging out with golfers. The ethics are different in those circles. Perhaps she saw you as foreigner and just wanted to make you feel at home, so she went out with you. It didn't mean you should kiss her and go for her breasts in her car. If she wanted something more than going out with you, she would let you know. These people are not shy and they don't hide things.
ERAL TRADE COMMISSION
COMMISSIONERS: Lina M. Khan, Chair
Rebecca Kelly Slaughter
Christine S. Wilson
Alvaro M. Bedoya
In the Matter of
CHEGG, INC., a corporation.
DECISION AND ORDER
DOCKET NO. C-
DECISION
The Federa ...
read full comment
ERAL TRADE COMMISSION
COMMISSIONERS: Lina M. Khan, Chair
Rebecca Kelly Slaughter
Christine S. Wilson
Alvaro M. Bedoya
In the Matter of
CHEGG, INC., a corporation.
DECISION AND ORDER
DOCKET NO. C-
DECISION
The Federal Trade Commission (“Commission”) initiated an investigation of certain acts and
practices of the Respondent named in the caption. The Commission’s Bureau of Consumer
Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP proposed to
present the draft Complaint to the Commission for its consideration. If issued by the
Commission, the draft Complaint would charge the Respondent with violations of the Federal
Trade Commission Act.
Respondent and BCP thereafter executed an Agreement Containing Consent Order (“Consent
Agreement”). The Consent Agreement includes: 1) statements by Respondent that it neither
admits nor denies any of the allegations in the Complaint, except as specifically stated in this
Decision and Order, and that only for purposes of this action, it admits the facts necessary to
establish jurisdiction; and 2) waivers and other provisions as required by the Commission’s
Rules.
The Commission considered the matter and determined that it had reason to believe that
Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue
stating its charges in that respect. The Commission accepted the executed Consent Agreement
and placed it on the public record for a period of 30 days for the receipt and consideration of
public comments. The Commission duly considered any comments received from interested
persons pursuant to Section 2.34 of its Rules, 16 C.F.R. § 2.34. Now, in further conformity with
the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the
following Findings, and issues the following Order:
Findings
1. The Respondent is Chegg, Inc., a Delaware corporation with its principal office or place
of business at 3990 Freedom Circle, Santa Clara, CA 95054.
4
2. The Commission has jurisdiction over the subject matter of this proceeding and over the
Respondent, and the proceeding is in the public interest.
ORDER
Definitions
For purposes of this Order, the following definitions apply:
A. “April 2018 Breach” means the exposure of individuals’ Covered Information from
systems of or controlled by Respondent in or about April 2018.
B. “April 2020 Breach” means the exposure of individuals’ Covered Information from
systems of or controlled by Respondent in or about April 2020.
C. “Clear and Conspicuous” or “Clearly and Conspicuously” means that a required
disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by
ordinary consumers, including in all of the following ways:
1. In any communication that is solely visual or solely audible, the disclosure must
be made through the same means through which the communication is presented.
In any communication made through both visual and audible means, such as a
television advertisement, the disclosure must be presented simultaneously in both
the visual and audible portions of the communication even if the representation
requiring the disclosure (“triggering representation”) is made through only one
means.
2. A visual disclosure, by its size, contrast, location, the length of time it appears,
and other characteristics, must stand out from any accompanying text or other
visual elements so that it is easily noticed, read, and understood.
3. An audible disclosure, including by telephone or streaming video, must be
delivered in a volume, speed, and cadence sufficient for ordinary consumers to
easily hear and understand it.
4. In any communication using an interactive electronic medium, such as the
Internet or software, the disclosure must be unavoidable.
5. The disclosure must use diction and syntax understandable to ordinary consumers
and must appear in each language in which the triggering representation appears.
6. The disclosure must comply with these requirements in each medium through
which it is received, including all electronic devices and face-to-face
communications.
5
D. E. F. G. H. I. J. 7. The disclosure must not be contradicted or mitigated by, or inconsistent with,
anything else in the communication.
8. When the representation or sales practice targets a specific audience, such as
children, the elderly, or the terminally ill, “ordinary consumers” includes
reasonable members of that group.
“Covered Incident” means any incident that results in Respondent notifying, pursuant to
a statutory or regulatory requirement, any U.S. federal, state, or local government entity
that information of or about an individual consumer was, or is reasonably believed to
have been, accessed, acquired, or publicly exposed without authorization.
“Covered Information” means information from or about an individual consumer,
including: (a) a first and last name; (b) a home or physical address; (c) an email address
or other online contact information, such as an instant messaging user identifier or a
screen name; (d) a mobile or other telephone number; (e) a driver’s license or other
government-issued identification number; (f) date of birth; (g) geolocation information
sufficient to identify street name and name of a city or town; (h) credit or debit card
information (including a partial credit or debit card number with more than 5 digits); (i)
user ID, or other persistent identifier that can be used to recognize a user over time and
across different devices, websites, or online services; or (j) user account credentials, such
as a login name and password (whether plain text, encrypted, hashed, and/or salted).
“Covered Information” does not include information that a user intends to make public
using Respondent’s services.
“Identified Breaches” includes the September 2017 Breach, April 2018 Breach, June
2019 Breach, and April 2020 Breach.
“June 2019 Breach” means the exposure of individuals’ Covered Information from
systems of or controlled by Respondent that was discovered in or about June 2019.
“Medical Information” means information relating to the health of an individual
consumer, including but not limited to medical history information, prescription
information, hospitalization information, clinical laboratory testing information, health
insurance information, or physician exam notes.
“Respondent” means Chegg, Inc., a Delaware corporation, and its successors and
assigns.
“September 2017 Breach” means the exposure of individuals’ Covered Information
from systems of or controlled by Respondent in or about September 2017.
Provisions
I. Prohibition Against Misrepresentations
IT IS ORDERED that Respondent, and Respondent’s officers, agents, employees, and
attorneys, and all other persons in active concert or participation with any of them, who receive
6
actual notice of this Order, whether acting directly or indirectly, in connection with promoting or
offering for sale any product or service, must not misrepresent in any manner, expressly or by
implication:
A. The extent to which Respondent collects, maintains, uses, discloses, deletes, or permits or
denies access to any Covered Information; and
B. The extent to which Respondent otherwise protects the privacy, security, availability,
confidentiality, or integrity of any Covered Information.
II. Data Retention and Deletion
IT IS FURTHER ORDERED that Respondent, within 60 days after issuance of this Order,
must:
A. B. Document and adhere to a retention schedule for Covered Information. Such schedule
shall set forth: (1) the purpose or purposes for which each type of Covered Information is
collected; (2) the specific business needs for retaining each type of Covered Information;
and (3) a set timeframe for deletion of each type of Covered Information (absent any
intervening deletion requests from consumers) that precludes indefinite retention of any
Covered Information; and
Provide a Clear and Conspicuous link on the homepage and initial login page of
Respondent’s websites directing consumers to an online form through which they can
request access to or the deletion of their Covered Information. Respondent must respond
to and fulfill every request either in accordance with the applicable consumer data access
and deletion rights and related procedures prescribed by applicable law in the consumer’s
jurisdiction of residence or, if the location of the consumer’s residence is unknown to
Respondent, or if there are no applicable laws in the consumer’s jurisdiction that provide
for consumer rights to access or delete Covered Information, then in accordance with the
consumer data access and deletion rights afforded by law to residents of the state in
which Respondent’s principal executive offices are located. If there are no laws that
provide consumers with rights to access or delete Covered Information within the state in
which Respondent’s principal executive offices are located, then Respondent must fulfill
any such requests within 45 days of receiving them. The time period to respond to the
request may be extended once by an additional 45 days when reasonably necessary,
provided the consumer is provided notice of the extension within the first 45-day period.
Provided, however, that any Covered Information that Respondent is otherwise required
to delete or destroy pursuant to this provision may be retained, and may be disclosed, as
requested by a government agency or otherwise required by law, regulation, court order,
or other legal obligation, including as required by rules applicable to the safeguarding of
evidence in pending litigation, or pursuant to written policies Clearly and Conspicuously
posted on Respondent’s websites relating to investigations or disciplinary actions by
educational institutions concerning academic integrity.
7
III. Multi Factor Authentication for Users
IT IS FURTHER ORDERED that within six months after issuance of this Order, Respondent
must provide multi-factor authentication methods as an option or as a requirement for consumer
users. This time period may be extended for a reasonable time if such extension is approved in
writing by a representative of the Commission. Respondent must not use, provide access to, or
disclose any information collected for multi-factor authentication for any other purpose, unless
such information is obtained separate and apart from enabling multi-factor authentication.
Respondent may use equivalent, widely adopted industry authentication options that are not
multi-factor, if the person responsible for the Information Security Program under sub-Provision
V.C: (1) approves in writing the use of such equivalent authentication options; and (2)
documents a written explanation of how the authentication options are widely adopted and at
least equivalent to the security provided by multi-factor authentication.
IV. Notice to Individuals
IT IS FURTHER ORDERED that Respondent, within 60 days after issuance of this Order,
must provide a notice to each individual whose unencrypted Social Security number, financial
account information, date of birth, user account credentials, or Medical Information was exposed
in an Identified Breach, to the extent such individual has not already previously been sent
notification by Respondent. The notice shall be delivered by email and shall include an exact
copy of the notice attached hereto as Attachment A (“Identified Breaches Notice”), with the
subject line “Information about Chegg Data Breach.” Respondent must not include with the
Identified Breaches Notice any other information, documents, or attachments.
V. Mandated Information Security Program
IT IS FURTHER ORDERED that Respondent and any business that Respondent controls,
directly or indirectly, in connection with the collection, maintenance, use, or disclosure of, or
provision of access to, Covered Information, must, within 90 days after issuance of this Order,
establish and implement, and thereafter maintain, a comprehensive information security program
(“Information Security Program”) that protects the security, availability, confidentiality, and
integrity of Covered Information under Respondent’s control. To satisfy this requirement,
Respondent must, at a minimum:
A. Document in writing the content, implementation, and maintenance of the Information
Security Program;
B. Provide the written program and any evaluations thereof or material updates thereto to
Respondent’s board of directors or governing body or, if no such board or equivalent
governing body exists, to a senior officer of Respondent responsible for Respondent’s
Information Security Program at least once every 12 months and promptly (not to exceed
30 days) after a Covered Incident;
C. Designate a qualified employee to coordinate and be responsible for the Information
Security Program;
8
D. Assess and document, at least once every 12 months and promptly (not to exceed 30
days) following a Covered Incident, internal and external risks to the security,
confidentiality, or integrity of Covered Information that could result in the
(1) unauthorized collection, maintenance, use, or disclosure of, or provision of access to,
Covered Information; or the (2) misuse, loss, theft, alteration, destruction, or other
compromise of such information;
E. Design, implement, maintain, and document safeguards that control for the internal and
external risks Respondent identifies to the security, confidentiality, availability, or
integrity of Covered Information identified in response to sub-Provision V.D. Each
safeguard must take into account the volume and sensitivity of the Covered Information
that is at risk, and the likelihood that the risk could be realized and result in the
(1) unauthorized collection, maintenance, use, alteration, or disclosure of, or provision of
access to, Covered Information; or the (2) misuse, loss, theft, destruction, or other
compromise of such information. Such safeguards must also include:
1. Training of all of Respondent’s employees, at least once every 12 months, on how
to safeguard Covered Information;
2. Documenting in writing the content, implementation, and maintenance of an
incident response plan designed to ensure the identification of, investigation of,
and response to the unauthorized access to Covered Information. Respondent
shall revise and update this incident response plan to adapt to any changes to its
assets or networks;
3. Implementing technical measures to log and monitor Respondent’s networks and
assets for anomalous activity and active threats. Such measures shall require
Respondent to determine baseline system activity and identify and respond to
anomalous events and unauthorized attempts to access or exfiltrate Covered
Information;
4. Policies and procedures to minimize data collection, storage, and retention,
including data deletion or retention policies and procedures;
5. Implementing data access controls for all assets (including databases) storing
Covered Information and technical measures, policies, and procedures to
minimize or prevent online attacks resulting from the misuse of valid credentials,
including: (a) restricting inbound and outbound connections; (b) requiring and
enforcing strong passwords or other credentials; (c) preventing the reuse of
known compromised credentials to access Covered Information; (d) implementing
automatic password resets for known compromised credentials; and (e) limiting
employee access to what is needed to perform that employee’s job function;
6. Requiring multi-factor authentication methods for all employees, contractors, and
affiliates in order to access any assets (including databases) storing Covered
Information. Such multi-factor authentication methods for all employees,
contractors, and affiliates should not include telephone or SMS-based
9
F. G. authentication methods and must be resistant to phishing attacks. Respondent
may use equivalent, widely adopted industry authentication options that are not
multi-factor, if the person responsible for the Information Security Program under
sub-Provision V.C: (1) approves in writing the use of such equivalent
authentication options; and (2) documents a written explanation of how the
authentication options are widely adopted and at least equivalent to the security
provided by multi-factor authentication;
7. Developing and implementing configuration standards to harden system
components against known threats and vulnerabilities. New system components
shall not be granted access to Respondent’s network, resources, or Covered
Information until they meet Respondent’s configuration standards;
8. Encryption of, at a minimum, all Social Security numbers, passport numbers,
financial account information, tax information, dates of birth associated with a
user’s account, Medical Information associated with a user’s account, and user
account credentials on Respondent’s computer networks, including but not limited
to cloud storage;
9. Policies and procedures to ensure that all information technology (“IT”) assets on
Respondent’s network with access to Covered Information are securely installed
and inventoried at least once every 12 months;
10. Implementing vulnerability and patch management measures, policies, and
procedures that require confirmation that any directives to apply patches or
remediate vulnerabilities are received and completed and that include timelines
for addressing vulnerabilities that account for the severity and exploitability of the
risk implicated; and
11. Enforcing policies and procedures to ensure the timely investigation of data
security events and the timely remediation of critical and high-risk security
vulnerabilities.
Assess, at least once every 12 months and promptly (not to exceed 30 days) following a
Covered Incident, the sufficiency of any safeguards in place to address the internal and
external risks to the security, confidentiality, or integrity of Covered Information, and
modify the Information Security Program based on the results;
Assess, prior to the acquisition of any entity that maintains, processes, or transmits
Covered Information (“Acquired Entity”), the effectiveness of that entity’s safeguards to
protect such information. Either during the acquisition due diligence process or
following such acquisition, Respondent must independently test the effectiveness of the
Acquired Entity’s safeguards to protect Covered Information. Respondent shall not
integrate any application or information system into its network(s) until (1) all material
risks to the security, confidentiality, and integrity of Covered Information identified in
such a test are remediated; and (2) such application or information system meets the
requirements of this Provision. Provided, however, that Respondent shall have 90 days
10
after integrating any application or information system of an acquired entity into its
networks to implement the requirements of sub-Provision V.E.6 with respect to such
application or system.
H. Test and monitor the effectiveness of the safeguards at least once every 12 months and
promptly (not to exceed 30 days) following a Covered Incident and modify the
Information Security Program based on the results. Such testing and monitoring must
include vulnerability testing of Respondent’s networks once every six months and
promptly (not to exceed 30 days) after a Covered Incident, and penetration testing of
Respondent’s networks at least once every 12 months and promptly (not to exceed 30
days) after a Covered Incident;
I. Select and retain service providers capable of safeguarding Covered Information they
access through or receive from Respondent, and contractually require service providers to
implement and maintain safeguards sufficient to address the internal and external risks to
the security, confidentiality, or integrity of Covered Information; and
J. Evaluate and adjust the Information Security Program in light of any changes to
Respondent’s operations or business arrangements, a Covered Incident, new or more
efficient technological or operational methods to control for the risks identified in sub-
Provision V.D of this Order, or any other circumstances that Respondent knows or has
reason to know may have an impact on the effectiveness of the Information Security
Program or any of its individual safeguards. At a minimum, Respondent must evaluate
the Information Security Program at least once every 12 months and modify the
Information Security Program based on the results.
VI. Information Security Assessments By A Third Party
IT IS FURTHER ORDERED that, in connection with compliance with Provision V,
Respondent shall obtain initial and biennial assessments (“Assessments”):
A. The Assessments must be obtained from a qualified, objective, independent third-
party professional (“Assessor”), who: (1) uses procedures and standards
generally accepted in the profession; (2) conducts an independent review of the
Information Security Program; (3) retains all documents relevant to each
Assessment for 5 years after completion of such Assessment; and (4) will provide
such documents to the Commission within ten days of receipt of a written request
from a representative of the Commission. The Assessor may not withhold any
documents from the Commission on the basis of a claim of confidentiality,
proprietary or trade secrets, work product protection, attorney-client privilege,
statutory exemption, or any similar claim.
B. For each Assessment, Respondent must provide the Associate Director for
Enforcement for the Bureau of Consumer Protection at the Federal Trade
Commission with the name, affiliation, and qualifications of the proposed
Assessor, whom the Associate Director shall have the authority to approve in her
or his sole discretion.
11
C. D. E. The reporting period for the Assessments must cover: (1) the first 180 days after
the issuance date of the Order for the initial Assessment; and (2) each two-year
period thereafter for 20 years after issuance of the Order for the biennial
Assessments.
Each Assessment must, for the entire assessment period:
1. Determine whether Respondent has implemented and maintained the
Information Security Program required by Provision V of this Order;
2. Assess the effectiveness of Respondent’s implementation and maintenance of
sub-Provisions V.A-J of this Order;
3. Identify any gaps or weaknesses in, or instances of material noncompliance
with, the Information Security Program;
4. Address the status of gaps or weaknesses in, or instances of material non-
compliance with, the Information Security Program that were identified in any
prior Assessment required by this Order; and
5. Identify specific evidence (including documents reviewed, sampling and
testing performed, and interviews conducted) examined to make such
determinations, assessments, and identifications, and explain why the
evidence that the Assessor examined is: (a) appropriate for assessing an
enterprise of Respondent’s size, complexity, and risk profile; and (b)
sufficient to justify the Assessor’s findings. No finding of any Assessment
shall rely primarily on assertions or attestations by Respondent’s
management. The Assessment must be signed by the Assessor, state that the
Assessor conducted an independent review of the Information Security
Program and did not rely primarily on assertions or attestations by
Respondent’s management and state the number of hours that each member of
the assessment team worked on the Assessment. To the extent that
Respondent revises, updates, or adds one or more safeguards required under
Provision V of this Order during an Assessment period, the Assessment must
assess the effectiveness of the revised, updated, or added safeguard(s) for the
time period in which it was in effect, and provide a separate statement
detailing the basis for each revised, updated, or additional safegua
Hope you'll now resort to eating Kentucky Fried Chicken breasts instead of messing with the breasts of ladies you know nothing about.
Hope you'll now resort to eating Kentucky Fried Chicken breasts instead of messing with the breasts of ladies you know nothing about.
Papa, all is not lost. Give your life to Jesus and work your salvation with fear and trembling. Life without God is meaningless.
One carnot succeed in this life by rejecting Almighty God. Learn from your mistakes. We are ...
read full comment
Papa, all is not lost. Give your life to Jesus and work your salvation with fear and trembling. Life without God is meaningless.
One carnot succeed in this life by rejecting Almighty God. Learn from your mistakes. We are all imperfect humans. Papa, why did you sell your 3 bedroom house? You could have rented it out. Anyway, I wish all the best in your endeavours.
Lesson for all guys.No ETOH and black American pussies.He could have filed for US citizen status 3 years after getting his Green Card being married to a US citizen.We pray for him.
Lesson for all guys.No ETOH and black American pussies.He could have filed for US citizen status 3 years after getting his Green Card being married to a US citizen.We pray for him.
What a pity. You think this life we live in is all about natural life?
Reading your story is very similar to mine. Your first error is coming to ghana to show off only 2 years after gaining your Green card. And with your Ame ...
read full comment
What a pity. You think this life we live in is all about natural life?
Reading your story is very similar to mine. Your first error is coming to ghana to show off only 2 years after gaining your Green card. And with your American daughter. Then your wife left you as soon you returned to America.
You dont have eyes to see spiritually otherwise you wouldn't visit ghana that early. Do you see the rest of the crises that has followed you.
Resilent? You lie bad.
My situation was worst than yours. I didn't have even a dime when things very very bad. You had $ to even start something in ghana and Turkey.
Seek Jesus Christ FIRST as i did later else you are a DEAD MAN.
Foolish man - he thought this was Ghana!
Foolish man - he thought this was Ghana!
Nothing bad will happen to you. America is not heaven. I did live in America for more than a decade and return to Ghana with almost nothing to show . Life still continues , l don't buy the annual jaket, l no longer buy any l ...
read full comment
Nothing bad will happen to you. America is not heaven. I did live in America for more than a decade and return to Ghana with almost nothing to show . Life still continues , l don't buy the annual jaket, l no longer buy any lips lotion, no more credit cards. I go to bed at 9pm to 5am everyday . My blood pressure is good.Masa,embrace your new location. Be thankful u made it home safely .
Copyright © 1994 - 2026 GhanaWeb. All rights reserved.