The Rundown: What you need to know about the FTC’s latest privacy crackdown

Observers may think, ‘Haven’t we seen this movie before?’ but nonetheless with proposals such as the American Data Privacy And Protection Act (ADPPA) under discussion by U.S. lawmakers such a shot over the bow needs to be heeded.

First, a recap…

The FTC is seeking comment from informed parties on a wide range of concerns including “the endless hoovering up of user data” and “potentially unlawful practices” according to committee chair Lina M. Khan. In particular, the body wants to know just where it has fallen short in the past, and exactly how can it future-proof its requirements, a crucial goal as the U.S. economy becomes increasingly digitized. By “building a robust public record” of comments from the public, she said the FTC will be better informed when it comes to deciding what any new rules should entail.

The agency also hopes to better understand how companies monetize personal information and how deceptive design or marketing tactics are used to “influence or coerce consumers into choices they would otherwise not make.” It also plans to examine how digital tools impact children and how companies use data to retaliate against customers.

“The FTC for many years, over two decades now, has really been on the front lines of using our existing enforcement tools to combat privacy violations and data security breaches,” Khan said last week during a press conference. “We’ve seen now that the growing and continuing digitization of our economy means that some of these practices will be prevalent and that case-by-case enforcement may fail to adequately deter law-breaking or remedy the resulting harms.”

The commission voted 3-2 to publish the Advanced Notice of Proposed Rulemaking (ANPR) with the window for comment submission closing 60 days after the notice is published.

The probe is extensive, here’s what matters to media players

The FTC probe shall cover a multitude of aspects of just how the digital economy operates. Areas of concern include companies’ consumer consent policies, disclosure of data collection practices to the public and the cost of potential remedies. Below are a few excerpts — questions and topics the FTC is seeking public comment about — that operators in the ad-supported media industry should bear in mind.

• To what extent, if at all, should new rules limit targeted advertising and other commercial surveillance practices beyond the limitations already imposed by civil rights laws?
• What alternative advertising practices can companies turn to if new rules prohibit the status quo?
• How cost-effective is contextual advertising as compared to targeted advertising?
• To what extent, if at all, should new trade regulation rules impose limitations on companies’ collection, use, and retention of consumer data?
• To what extent should the FTC require companies to make public their commercial surveillance practices? 
• How often, if at all, should the FTC require self-reporting, third-party audits or assessments of their commercial surveillance practices?

So, what now?

The ANPR includes a September 8 forum where members of the public can share their views on whether new rules are needed to protect the public’s privacy and information in a virtual event.

The agency’s lengthy rule-making process gives the agency “ample time to reassess” plans based on any developments in Congress, Khan said while noting that public feedback will also inform federal privacy policy beyond the agency itself.

The FTC’s process of rule-making is by no means short. If the FTC moves forward after the public comment period, it would have to give Congress a 30-day notice before publishing a proposal which will be followed by an additional public notice and comment period followed by informal hearings. Before developing any final rules, the FTC would also conduct a regulatory analysis and then would need to publish any updated regulations 30 days before they go into effect. Only then would the agency be able to begin enforcement against anyone who violates the regulations “with actual knowledge or knowledge fairly implied.”

Mark Pearlstein, CRO at Permutive, noted how the latest developments further telegraph how the industry has to step out of its comfort zone. He added: “If Big Tech is reluctant to put customer privacy first, as we’ve seen with Google’s delays in third-party cookie deprecation, does the FTC really have a choice?”

During last week’s press conference, FTC Commissioner Rebecca Kelly Slaughter said the agency has a “duty” under existing law to address unlawful behavior. However, she added that any new rules the FTC approves would be “complementary, not an alternative,” to new Congressional legislation. (FTC Commissioner Alvaro Bedoya also pointed out that he won’t vote for any rules that overlap with the ADDPA.)

“Opening a record like this is important for the FTC … showing that we’re no longer shying away from using all the tools we have available to deter unlawful conduct in the market,” Kelly Slaughter said.