Photo of Timothy A. Butler

Timothy A. Butler

Tim Butler helps companies thrive by developing tailored strategies to address their regulatory compliance challenges and vigorously defending them in government enforcement actions and bet-the-company lawsuits.

A former prosecuting attorney for the Federal Trade Commission (FTC) and former senior official in the Georgia Attorney General’s Office, Tim has led the defense of dozens of government investigations and enforcement actions brought by the FTC, the Consumer Financial Protection Bureau (CFPB), and the various state attorneys general. Tim also regularly defends clients in bet-the-company lawsuits, including complex business disputes and consumer class actions alleging privacy, false advertising, and unfair or deceptive business practice claims.

Tim is an experienced guide for companies struggling with regulatory complexity. He offers clear advice that helps his clients meet the demands of the ever-growing set of laws and regulations governing data privacy and cybersecurity, advertising and marketing practices, and consumer financial products and services. Clients rely on Tim’s business-minded and practical strategies to address their most difficult regulatory compliance challenges.

A graduate of the University of Chicago and Stanford Law School, Tim is a prolific author and regularly speaks to industry and trade groups about the evolving privacy landscape, about cutting-edge issues affecting payments and fintech companies, and about developments at the FTC, the CFPB, and within the state attorneys general community.

On July 10, 2026, New York City Department of Consumer and Worker Protection (DCWP) finalized and adopted its “Click-to-Cancel Rule,” which takes effect on Oct. 1, 2026.
Continue Reading NYC Finalizes Click-to-Cancel and Hotel Junk Fees Rules, Proposes New Junk Fees Rule

Texas Attorney General Ken Paxton sued Discord under the Texas Deceptive Trade Practices Act, alleging false safety representations and default settings that expose minors to exploitation risks. 

Continue Reading Texas AG Secures Temporary Restraining Order Against Discord Over Alleged Deceptive Safety Practices

Texas AG Ken Paxton states that the drone company misrepresented its data privacy and security practices to consumers in violation of the Texas Deceptive Trade Practices Act and allegedly concealed ties to China.

Continue Reading Texas Attorney General Announces Investigation into Drone Company over Data Privacy, Surveillance Concerns

The Federal Trade Commission announced a stipulated final order resolving its enforcement action against data broker Kochava Inc. and its subsidiary Collective Data Solutions.

Continue Reading FTC Bars Kochava from Selling Sensitive Location Data

On April 29, 2025, Michigan Attorney General Dana Nessel filed a lawsuit against Roku, Inc., alleging that the company collects and monetizes personal data from children without proper consent. The lawsuit claims that Roku’s practices violate the Children’s Online Privacy Protection Act (COPPA) and other privacy laws.
Continue Reading Michigan Attorney General Takes Action Against Roku, Alleging COPPA Violations

On Nov. 12, 2024, the Consumer Financial Protection Bureau (CFPB) released a report examining federal and state privacy protections for consumers’ financial data. In the report, the CFPB “critiques” the privacy protections available under the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA), asserting that the federal framework has “limitations.” The CFPB then

On Oct. 22, 2024, the CFPB issued a final rule that will require covered financial institutions to provide consumers and authorized third parties with access and portability options for their financial data. The CFPB’s final rule, called the “Personal Financial Data Rights Rule,” implements Section 1033 of Title X of the Dodd-Frank Act, a to-date