FTC Releases Commercial Surveillance and Data Security Advanced Notice of Proposed Rulemaking

The FTC recently issued its “Commercial Surveillance and Data Security Advance Notice of Proposed Rulemaking” (also referred to as the Trade Regulation on Commercial Surveillance and Data), which marks the beginning of the Federal Trade Commission’s (FTC’s) rulemaking process. The Commercial Surveillance and Data Security Advance Notice ANPR provides the FTC with the opportunity to obtain public comment and draft rules that would restrict commercial surveillance and lax data security practices. The FTC voted (3 - 2) to advance the ANPR, with Commissioners Phillips and Wilson dissenting. Although the vote was along party lines, all five commissioners agree that a strong federal privacy law would be preferable to FTC rules. It is unclear how the FTC’s rulemaking will affect congressional efforts—some say the ANPR will provide Congress with the nudge it may need to pass privacy legislation, while others see the rulemaking as undermining congressional efforts. Comments are due on October 22, 2022.

What Do You Need to Know? Key Takeaways

• The ANPR serves two key functions, outside of laying the groundwork for rulemaking: 1) it signals the FTC’s potential enforcement priorities, as the information received could support or accelerate the agency’s potential enforcement actions; and 2) it creates a public record, which could be used by Congress and by state regulators to inform their legislative activities. Companies should consider whether and how to participate, as the ANPR creates an opportunity for education and advocacy. 
• The FTC is clear in the ANPR that this rulemaking applies to employees. It spends a few questions diving into the impact of worker surveillance and the impact of automation on employees. That said, the majority of the questions are focused on “commercial surveillance.” The questions are specifically focused on surveillance advertising, even referencing the Accountable Tech petition on surveillance advertising filed this year. From the business models to notice, the ability to obtain informed consent, purpose limitations and the impact of opting out, the FTC has included a range of questions on this topic. In addition, the ANPR highlights harm to children, including teens up to age 18, as well as bias in AI as key areas of focus. These are the areas that have been flagged by President Biden as well as earlier statements from the FTC. 
• The FTC is asking for details on problems, solutions and consequences, and leaves some space to inquire about the impact of regulation, including the impact on competition and innovation. While it is not clear how much weight will be placed on the answers to these questions, we hope to see some meaningful information provided. 

What Is Commercial Surveillance?

In the ANPR, “commercial surveillance” is defined as collecting, analyzing and profiting from information about people. 

Understanding the FTC’s Focus

The FTC is largely focused on targeted/surveillance advertising. In the statement from Commissioners Khan and Slaughter as well as the preamble to the ANPR, it is very clear that the FTC’s focus is on the impact of widespread data collection and use on consumers. The preamble notes that goods and services are designed to collect vast amounts of data, and in some cases consumers are not aware of what is collected or how it is used. The ANPR is designed to gather information on the harms and the causes of those harms. 

With this increase in information comes a risk of bias as data is fed into AI and other automation tools. The FTC indicated a concern over algorithmic failures, including the use of biased data. The ANPR highlights the harm from bias in algorithms and automated decision-making, along with the harms to children, as key areas of focus. 

While data security is named, it gets a small amount of airtime in the ANPR. The FTC notes that the increased volume of information being stored by companies creates a risk for consumers from hackers and identity theft. 

Understanding What the FTC Is Asking

With almost 100 questions, the ANPR is extensive and designed to elicit a comprehensive response. The ANPR invites public comment on: 

The nature and prevalence of harmful “commercial surveillance” practices

The FTC can only promulgate rules that are specifically defined, regarding practices that are deemed to be prevalent. With that in mind, the ANPR is designed to build a public record that will support a finding that certain practices are prevalent. Numerous questions are devoted to the practices used in connection with “commercial surveillance,” as well as to the business models or other factors that incentivize surveillance. The FTC is also looking for information to help it determine whether certain activities should be treated as “deceptive” or “unfair”—the two avenues for enforcement under Section 5, FTC Act. On deception, the FTC digs into the role of disclosures, material updates to privacy policies and practices, and the ability to provide meaningful consent to those updates. On the unfairness prong, the FTC is looking at the nonquantifiable harms that may result from commercial surveillance. The ANPR dedicates several questions to the role of bias in AI, including in design, under-representative data sets and other areas likely to result in algorithmic unfairness.

The ANPR also seeks comments on harm to children, including teens. The ANPR asks about the role of an erasure button, parental consent, enhanced disclosures, or complete restrictions of certain activities involving children or teens. The FTC also appears to be looking to expand the scope of the Children’s Online Privacy and Protection Act (COPPA) beyond child-directed websites, and asks for comments on whether companies should be required to know the ages of their consumers. 

The balance of costs and countervailing benefits of these practices for consumers and competition

The FTC doesn’t just focus on the problems; it asks for solutions and for information on the impact of those solutions and of rulemaking more broadly. Notably, the ANPR flags that rulemaking may impact competition and innovation, and it seeks comments on that point. In addition, the ANPR seeks information about the benefits of commercial surveillance to consumers and the potential impact of restrictions (which could see consumers paying to access certain services). 

The FTC also appears to seek information on the limits of its authority and expertise. It asks for feedback on the role of self-regulation and whether it or some other entity would be best positioned for some of the certifications, audits and assessments referenced in the ANPR. The ANPR also seeks feedback on the impact of Section 230 and the First Amendment in limiting the agency’s ability to conduct rulemaking. As a reminder, rulemaking is subject to initial hearings and judicial review once finalized. Memorializing the strongest legal arguments through comments is a good idea and could also provide commenters with a basis to challenge the rulemaking in the future. 

Proposals for protecting consumers from harmful and prevalent commercial surveillance practices 

Finally, the ANPR looks for solutions that may protect consumers from “commercial surveillance.” For example, the ANPR asks for comment on whether opt-out choices have proved effective and, if so, in what contexts. 

Understanding What This Means for Your Company

The FTC issued its ANPR pursuant to its Section 18 authority (commonly referred to as Magnuson-Moss or Mag-Moss). Under Section 18 of the FTC Act, the FTC is authorized to prescribe “rules which define with specificity acts or practices which are unfair or deceptive acts or practices in or affecting commerce” within the meaning of Section 5—these rules are called trade regulation rules. A final trade regulation rule protecting consumer privacy would be significant, as it would provide the FTC with the necessary enforcement tools to go after first-time offenders (who would be subject to civil penalties). The FTC believes that a final rule would also bring greater clarity to businesses around their legal obligations and deter bad behavior.

It’s important to keep in mind that the FTC’s Section 18 rulemaking is a lengthy, multi-step process that could take years. The FTC actually streamlined some of its Mag-Moss rulemaking procedures back in 2021, but the privacy rulemaking could still take years. It is also unclear how those recent procedural changes will affect the timeline for the overall rulemaking process. 

Comments on the ANPR are due on October 21 (60 days from publication of the ANPR in the Federal Register). In the meantime, the FTC is hosting a virtual public forum  on commercial surveillance and data security on Thursday, September 8, 2022, from 2 to 7:30 p.m. ET. 

Companies have an opportunity to provide feedback and perspective on the ANPR’s questions, either in their own name, anonymously or through an organization. From explaining practices and identifying the scope and limits of harm to identifying protective measures and detailing the potential harms to competition and innovation, this is an opportunity to have all voices heard. 

Loeb & Loeb is working with a number of companies on a response to the ANPR. If you would like to discuss this and the implications of the ANPR in more detail, or if you are considering providing comments on specific areas/topics or are looking for an outlet for aggregate comments, please reach out to Jessica Lee or Robyn Mohr.