This law was recently used to challenge organizations that allegedly made deceptive claims regarding the privacy and security of customers’ personal information.