The FTC enforcement actions provide useful examples of the requirements expected of an entity that shares sensitive personal data with external service providers. In a number of its enforcement actions, the FTC has critiqued companies for inadequate third party management13 and, most recently, has taken enforcement actions to make the point.14 The message is clear that the FTC is now requiring companies to: