On August 11, 2022, the Federal Trade Commission (the FTC or the Commission) published an Advance Notice of Proposed Rulemaking (ANPR) to request public comment on the prevalence of "commercial surveillance and data security practices that harm consumers." This is the first concrete step by the agency to explore using its Section 18 rulemaking authority under the FTC Act to issue a broad consumer privacy-focused trade regulation rule. This is an important first step in a lengthy process, as it identifies the key areas of focus for the FTC commissioners. Below we provide an overview of some of our key takeaways from the ANPR, highlight the topics the FTC is focused on, and then outline next steps for the Commission as well as for our clients that are interested in participating in the rulemaking process.
We encourage companies to think about these issues carefully—this is an important step in the process of developing a potential broad overall privacy rule. At the same time, the FTC clearly is signaling concerns with specific practices it may seek to examine and has framed many of the questions in a somewhat adversarial manner that seems to presume negative impacts from specific kinds of data processing activities.
- The publication of the ANPR appears timed to influence the federal legislative debate over the bipartisan American Data Privacy and Protection Act (ADPPA), which is currently in the House Committee on Energy and Commerce (having been ordered to be reported in late July 2022). At the same time, it also is designed—at least in part—as a backstop in the event that Congress does not pass a federal privacy bill. Many of the commissioners acknowledged the ADPPA in their statements, with Commissioner Alvaro Bedoya (D) clearly stating that he would not vote for any rule that would overlap with the ADPPA should it pass. Commissioner Christine Wilson (R), writing in dissent from the issuance of the ANPR, emphasized her support for the legislation and noted that one reason for her opposition to the ANPR was its potential to derail that broader legislative effort. Whether the ANPR is able to move the passage of the ADPPA forward remains to be seen but will certainly be a factor that Congress considers as it decides whether or not to continue to advance the bill. Our view at this point is that this process is both a way to increase the pressure on Congress and a fallback option that may become more important if Congress does not act while this rulemaking procedure is underway.
- The questions identified by the Commission cover an enormously broad range of topics and lack specificity. In addition, they are often framed as assuming that harm results from a particular practice (presumably reflecting the existing policy views of the key commissioners advancing this process). Even the use of the term "commercial surveillance" to discuss consumer data processing generally suggests that there is something inherently bad about the practice, despite the fact that it is at the very heart of our techno-centric economy and integral to our daily lives. Companies will need to think carefully about whether to offer comments in response to the ANPR and, if they do, what to focus on and how best to approach offering feedback to the agency in a way that resonates with the FTC and staff.
- We encourage companies to consider these issues not only in the context of this rulemaking process but also in terms of current operations. The issues raised by the FTC clearly reflect ongoing concerns, and we anticipate that the topics raised here will be the subject of investigative inquiries during the pendency of this rulemaking procedure.
- As a general matter, the approach taken by the Democratic commissioners to the rulemaking process and the focus of the questions in the ANPR will not surprise anyone who has been watching the FTC over the past year and has read the previous comments of the newest commissioner, Alvaro Bedoya, who is the primary point person for these efforts. Of note, reflecting the underlying scope of Section 5 of the FTC Act, the FTC is interested in exploring whether certain types of data practices are fundamentally unfair, and whether substantive limits on data collection or bans or prohibitions on certain practices might be necessary to adequately protect consumers. Commissioner Rebecca Slaughter (D) and Chair Lina Khan (D) clearly signaled in recent speeches their interest in moving away from procedural protections like notice and consent and toward more substantive limits. The commissioners are also interested in how automated systems discriminate based on protected categories, and how that should be addressed by the agency.
- One primary focus of the Commission's efforts is to evaluate how the lives of children and teens intersect with and are shaped by technology. The Commission has long viewed itself as responsible for protecting children online, including through its enforcement of the Children's Online Privacy Protection Act (COPPA). Despite its inability to update the COPPA rule, which has been under review since 2019, the FTC appears poised to move beyond narrowly enforcing against children's privacy violations and thinking more broadly about how to protect both "children" as defined by COPPA and teens from a myriad of potentially unfair practices, especially in light of their developmental status. Companies that collect data from teens should be thinking about substantive protections they can provide this class of individuals, both now and as this rulemaking proceeds.
- The Commission is looking beyond harms to individual consumers to how it can protect small businesses and employees; the former have been the subject of many recent enforcement actions, and the latter are seen as under threat from increased "workplace surveillance" resulting from the COVID-19 pandemic. Employers will want to be attuned to how they are approaching tracking, collection and analysis of worker data, and companies whose clients are small businesses rather than individual consumers should understand their practices will be scrutinized by the Commission. This focus on employees also may extend beyond the current debate in Congress, which largely has not included employee data in the scope of various legislative proposals.
- The ANPR seemed almost inevitable in light of the Supreme Court's decision in AMG Capital Management LLC v. FTC and the FTC's quest to obtain the authority and tools it believes are necessary to monitor privacy and data security abuses (in addition to the clear concerns from some of the commissioners about a lack of congressional action). As the ANPR notes, (1) the FTC Act limits the remedies that the Commission may impose in enforcement actions on companies for violations of Section 5 in that the statute generally does not allow the Commission to seek civil penalties for first-time violations of that provision; (2) while the Commission can enjoin conduct that violates Section 5, as a matter of law and policy enforcement, such relief may be inadequate in the context of commercial surveillance and lax data security practices; and (3) even in those instances in which the Commission can obtain monetary relief for violations of Section 5, such relief may be difficult to apply to some harmful commercial surveillance or lax data security practices that may not cause direct financial injury or, in any given individual case, do not lend themselves to broadly accepted ways of quantifying harm.
- The earlier-discussed dissent from Commissioner Wilson and the dissent from Commissioner Noah Phillips (R)—who announced his fall 2022 resignation just three days before the release of the ANPR—clearly lay out the issues Republicans have had with recent efforts by the activist majority at the FTC to look for additional sources of authority. In his dissent, Commissioner Phillips calls the ANPR a "naked power grab." He critiques the ANPR as a vehicle for positioning FTC rules as "on par with statutes passed by elected legislators." His dissent walks through examples that Phillips believes demonstrate the FTC's overreach—for instance, the ANPR's contemplation of policing algorithms for disparate impact or discrimination; regulating the relationship between employers and employees in relation to data; and constraining business practices in a way that may impact competition. This isn't his only critique. He argues that the ANPR fails to communicate its own objectives or regulatory alternatives, or put forth the number and scope of rules envisioned. He writes that the questions themselves don't provide the detail necessary for commentators to prepare responses. Last, Commissioner Phillips believes that the ANPR shortchanges other issues that are ripe for FTC rulemaking (for example,
- privacy issues like clarification on whether there should be different rules based on the sensitivity of data)—in essence, wasting the opportunity to develop useful rules in data security and privacy.
Questions for Comment
The ANPR poses a series of 95 questions for public comment. These questions address a number of topics, including:
- Practices potentially resulting in harms to consumers. These high-level questions approach, at a general level, consumer surveillance (overall data collection and use) and data security practices, attempting to expand on the potential consumer harms mentioned in the ANPR. They solicit feedback on the measures taken by companies in both spaces, the kinds of harms that may result, the categories of data that should be subject to regulation, and the types of consumers who might be impacted. The questions also ask about the impact and scope of prior FTC actions.
- Practices potentially resulting in harms to children and teens. This section invites comment on surveillance practices and data security measures that may impact children and teens. Questions relate to (1) practices or measures to which children or teenagers are particularly susceptible, exploring whether children and teenagers are more likely than adults to be manipulated by practices that encourage the sharing of personal information; (2) what measures—beyond those required under COPPA—might best protect children or teenagers from harmful commercial surveillance practices; (3) techniques that manipulate consumers into prolonging online activity (e.g., video autoplay, infinite or endless scroll, quantified public popularity); and (4) potential rules that set clear limits on personalized advertising to children and teenagers irrespective of parental consent. The questions also solicit feedback on what rules may block or help stymie the spread of child sexual abuse material. It is worth noting that the FTC is focused on reducing harms to teens both through education technology (see our recent blog post) and through social media platforms.
- Weighing the costs and benefits of current practices, including the time horizon over which such calculus should be made. These questions acknowledge that the Commission will have to weigh the impact of regulations on innovation and competition against preventing the harms discussed throughout.
- Whether and how to approach Section 18 rulemaking and trade regulations, including tailored questions relating to data security and collection, use, retention and transfer of consumer data. This section invites feedback on whether existing legal authority and extralegal measures (such as self-regulation) are already effective or sufficient to address pertinent harms.
- Automated systems, including the impact of automated decision-making practices and algorithmic error. Implicit in the questions is a recognition that automated systems should also be subject to a cost/benefit analysis. For instance, companies may employ automated decision-making systems in critical areas such as housing, credit and employment where those systems may facilitate both positive and negative outcomes.
- Algorithmic discrimination, including in relation to protected classes and other underserved groups. This set of questions explicitly recognizes that the FTC will have to navigate existing legislation and the work of civil rights agencies.
- The effectiveness and administrability of consumer consent. Here, the FTC invites feedback on whether consumer consent (i.e., opt-in and opt-out consent) is helpful in evaluating whether a practice is unfair or deceptive. Likewise, to what extent and how should the FTC require companies to abide by consumer choice?
- The effectiveness of company notice, transparency and disclosure. This includes questions concerning the extent to which companies shield their practices from the public.
- Remedies (e.g., relief and damages). This section addresses whether or how new rules should enumerate specific forms of relief, including potentially algorithmic disgorgement. Here, the FTC acknowledges that there is an open question as to whether the FTC has authority to implement remedies by regulation.
- The potential obsolescence of any future rulemaking. The FTC inquires as to how its rulemaking process should account for inevitable changes in business models over time, including in commercial surveillance practices.
The filing of the ANPR to the Federal Register (which has not yet happened as of the date of this article) will open a 60-day public comment period, during which members of the public can share feedback. Any member of the public can submit a comment on the rulemaking, on general topics or relating to a specific question. Further instructions on how to submit comments can be found in the ANPR itself or on the FTC website.
On September 8, 2022—the end of the 60-day period—the FTC will hold a virtual public forum to discuss the ANPR, provide space for commissioner remarks and panel discussions, and invite public feedback. In order to speak at the forum on September 8, members of the public must register in advance.
After the 60-day period, the FTC will issue a Notice of Proposed Rulemaking with the proposed text of the rule, including any alternatives, incorporating information received (at which point members of the public will have another chance to respond during a second public comment period), and may schedule an informal hearing. After public participation, the FTC will publish a final rule that will include a statement of basis and purpose, detailing (1) the prevalence of the practices addressed by the rule; (2) how the practices are unfair or deceptive; and (3) the economic effect of the rule, taking into account its potential effect on small businesses and consumers. Within 60 days of the final rule's promulgation, any consumer or organization may file a petition seeking judicial review of the rule. Courts may direct the FTC to consider additional submissions or set the rule aside.
We will continue to provide analysis and coverage of the FTC's efforts in this space.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.