It's interesting to see the FTC bringing this based on injuries to the consumers themselves. We've previously discussed a regulatory body such as the FCC regulating the externalities of networking bugs. Here, the damages are internal to the consumer. It makes sense the FTC acts here, where individual damages could be very difficult to prove, if even discover. But query whether the potential for a class action suit (and lack thereof) have already suggested the proper result here. While this claim seems well-placed, hopefully, both the FTC and the court weighing the claim will establish a reasonable "foreseeableness" limit to the liability such that potential claims as this don't quell innovation in the space.
Case wouldn't get that far. It'll settle before there's any assessment of liability. Probably end with a consent order and a suspended judgment. So basically, they have to submit to compliance audits once a year, and there's an order in place that triggers liability if they violate the same law again. That accomplishes your foreseeable principle.
