permits that activity. At bottom, the question of whether regulations can create safe harbors simply was not before the Cel-Tech Court, and therefore any intimation on this point was non-essential dicta. Rather, we follow our previous decision in Webb v. Smart Document Solutions, LLC, where we observed that if HIPAA regulations “intended to permit [the defendant’s] conduct, it cannot be'unfair’ under Section 17200.” 499 F.3d 1078, 1082 (9th Cir.2007). We therefore recognize that Regulation Z does provide a safe harbor for Defendants’ disclosures in the online application. We would add that even if regulations could not create safe harbors, Davis does not deny that federal statutes can. Indeed, we have held as much. See Hauk v. JP Morgan Chase Bank USA 552 F.3d 1114, 1122 (9th Cir.2009) (<HOLDING>). In this ease, to reiterate, TILA not only
holding that uses which are not ultimately included in a submission to the fda are nonetheless exempted by the safe harbor holding arbitration clause in credit card agreement unconscionable holding that a credit card issuers compliance with tilas disclosure requirements provides a safe harbor with respect to the plaintiffs ucl claims based only on the sufficiency of the issuers disclosures holding that sanctions under rule 11 are unavailable unless the motion for sanctions is served on the opposing party for the full twentyone day safe harbor period before it is filed with or presented to the court holding that plaintiffs could only pursue ucl claims via assignment if they satisfied class action requirements