Policy

The FTC's next privacy move is a dangerous game years in the making

Tech's de facto regulator has been taking half measures for decades as Congress fails on data protection. That might soon change.

FTC chair Lina Khan

The FTC has been clearing the way to issue more rules governing whole industries.

Photo: Graeme Jennings/AFP via Getty Images

After many years of "concerns" and false starts, the FTC appears poised to tell tech companies what they must do — and stop doing — to protect consumer privacy.

Crafting actual privacy rules is an ambitious undertaking that has eluded Congress for more than a decade. But the FTC, under new chair Lina Khan, seems ready to regulate most of the digital services industry and a good chunk of the "offline" world to boot. If history's any guide, any move is sure to spur furious pushback that could endanger even the FTC's basic powers.

It's also something that Khan and the other two Democrats on the commission have been readying for months, after years of half-measures by the agency charged by default with regulating Big Tech.

The Wall Street Journal reports that the commission is considering opening a new rulemaking procedure, likely using its authority to regulate specific "unfair or deceptive acts." The new rules would allow the commission to act without waiting for Congress to decide on an approach for certain fraught issues, such as whether tech platforms should face consumer lawsuits for privacy violations.

"There are now some pretty good indications that the Federal Trade Commission is going to have, or begin, rulemaking on privacy," said Sen. Richard Blumenthal, who led Democratic colleagues in a letter urging a rulemaking in September, during a hearing soon after the Journal report. "This development would be very, very welcome."

New, privacy-specific rules would be a far cry from how the FTC has dealt with Big Tech's practices in the past. For the history of modern tech as we know it, the agency's approach has been a narrow one. Essentially, the FTC has focused on a few high-profile companies that appeared to be lying to users about their privacy practices, then reached settlements with those firms saying they could face large fines for future violations where a company's actions didn't match its consumer-facing statements. If one of those companies was later found to be violating the terms of those settlements, the FTC was then able to extract actual money — such as the agency's $5 billion total fine on Facebook in the wake of the Cambridge Analytica scandal — and promises of future better behavior.

That emphasis on repeat offenders is written into the law, but the focus on the worst conduct from the biggest players is an outgrowth of budget constraints. To the FTC's credit, chairs from both parties have long sought the ability to punish companies the first time they break the law, as well as for more resources from Congress.

But until now, the idea of the FTC forcing the whole industry to abide by privacy rules appeared to be unfathomable, outside of children's privacy. As recently as last year, an in-house FTC report called the commission's rulemaking powers, which are more time-consuming than other agencies', "an imperfect tool for the rapidly evolving space of data privacy." The FTC pleaded for Congress to do the work that voters demanded — maybe giving the agency some expedited power to adjust technical definitions in the process — but commission leadership essentially ignored the possibility that it could take over the whole project.

That appears to have changed in recent months. Even one of the FTC's Republican commissioners, Christine Wilson, testified before Congress in July that she "had become more receptive" to FTC rulemaking on privacy "to address the information asymmetry between the providers of goods and services and their users," though she also said her doubts had grown again because of how Khan has run the commission.

Advocates of FTC-only action largely still would prefer that Congress take the lead, but they're increasingly unwilling to wait around for lawmakers to pass a bill.

"Congress just hasn't done its job," Justin Brookman, head of tech policy for Consumer Reports, said in a tweet. He cited a failed privacy bill from the year 2000 to make his point, calling for the FTC to jump into the rulemaking process.

Blumenthal likewise said Congress had "failed abjectly to fulfill its responsibility" and said "the FTC is supposed to fill gaps," such as the absence of broad federal privacy rules.

Laying the groundwork

Within her first few weeks as chair, Khan, a vocal tech skeptic, began to clear a path so the FTC wouldn't have to wait much longer. In July, during the first of the public meetings that she instituted, Khan and the Democrats voted to streamline the FTC's procedure for rulemaking, although it remains particularly cumbersome. Her fellow Democratic commissioner Rebecca Kelly Slaughter, who had pushed for more rulemaking before Khan joined the commission, argued during the meeting that Congress' grant of regulatory authority sent "a clear directive to the FTC to promulgate trade rules to protect consumers in the dynamic and changing economic landscape."

When the FTC voted to streamline its rulemaking in July, it also moved to broaden its powers to police "unfair methods of competition," and floated the possibility of new rules on the issue. And Congress is considering $1 billion for a privacy bureau at the FTC.

Shortly after Khan took over as chair, President Joe Biden issued an order urging the FTC to tackle competition, including attention to "unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy."

Since then, Khan has also made clear her first task as chair is to understand not just what tech companies want to talk about, but the underlying business models and incentives that truly drive them, such as Facebook's roaring advertising business that sucks up so much user data.

Biden in September also nominated privacy hawk Alvaro Bedoya to join the commission, now that Democrat Rohit Chopra is leaving to head up the Consumer Financial Protection Bureau. Accountable Tech, a Democratic-allied group that's been critical of the industry, also recently formally petitioned for rulemaking on "surveillance advertising" — casting the technology that powers Big Tech companies like Google as a threat to competition.

Despite this seemingly broad support, however, any FTC effort will face plenty of headwinds. The potential avenues for regulating privacy are immense, ranging from ads and children's privacy to connected devices' listening techniques, health apps, data brokers, the civil rights implications of algorithms, computer hacks and even the competitive dynamics affecting privacy. Brick-and-mortar retailers have even become enmeshed in online privacy debates if they have ecommerce sites. Each of these issues, by itself, has stymied the commission for years — let alone any attempt to roll them up together.

The opposition is also coming from inside the house. In a joint opinion piece on Wednesday, the FTC's other Republican commissioner, Noah Phillips, and two top Republican lawmakers who have been working on privacy legislation called any potential privacy rulemaking "blatant overreach that would almost certainly invite legal challenges."

"The legislative process may be slower than some would prefer, but that is no basis for executive agencies to usurp the people's elected representatives and the powers granted them by the Constitution," wrote Phillips, Sen. Roger Wicker, and Rep. Cathy McMorris Rodgers.

Litigation could tie up any new rules up for years, but from the commission's perspective it may be the lesser evil as compared to drawing ire from Congress. Critics of FTC inaction trace the agency's timidity to the 1980s. At the time, many saw the FTC's attempts to regulate children's advertising as the height of nanny-state overreach, in part thanks to a campaign by advertisers. In response to "kidvid," Congress reined in the agency's regulatory powers — and in the process taught generations of FTC staff to tiptoe around lawmakers.

It's a cycle that's recurred throughout FTC's existence, and Khan, who loves the agency's history, has made clear she's well aware of it.

Her colleagues, too, seem well aware that the clock is ticking: In a speech earlier in October, Slaughter discussed online ads and pushed the idea that companies should only collect data necessary for their offerings.

"I am confident that it is time for us to start asking the questions and developing the record, before the practices about which we are concerned become even more entrenched," she said. "The market is changing whether we promulgate rules or not."

A MESSAGE FROM ALIBABA

www.protocol.com

The future of retail is digital, experiential – and happening now in China. U.S. businesses are going digital and using Alibaba to create immersive experiences to sell to the 900 million Chinese consumers on Alibaba's ecommerce platforms.

LEARN MORE

Workplace

It's OK to cry at work

Our comfort with crying at work has changed drastically over the past couple years. But experts said the hard part is helping workers get through the underlying mental health challenges.

Tech workers and workplace mental health experts said discussing emotions at work has become less taboo over the past couple years, but we’re still a ways away from completely normalizing the conversation — and adjusting policies accordingly.

Photo: Teerasak Ainkeaw / EyeEm via Getty Images

Everyone seems to be ugly crying on the internet these days. A new Snapchat filter makes people look like they’re breaking down on television, crying at celebratory occasions or crying when it sounds like they’re laughing. But one of the ways it's been used is weirdly cathartic: the workplace.

In one video, a creator posted a video of their co-worker merely sitting at a desk, presumably giggling or smiling, but the Snapchat tool gave them a pained look on their face. The video was captioned: “When you still have two hours left of your working day.” Another video showed someone asking their co-workers if they enjoy their job. Everyone said yes, but the filter indicated otherwise.

Keep Reading Show less
Sarah Roach

Sarah Roach is a news writer at Protocol (@sarahroach_) and contributes to Source Code. She is a recent graduate of George Washington University, where she studied journalism and mass communication and criminal justice. She previously worked for two years as editor in chief of her school's independent newspaper, The GW Hatchet.

Sponsored Content

Foursquare data story: leveraging location data for site selection

We take a closer look at points of interest and foot traffic patterns to demonstrate how location data can be leveraged to inform better site selecti­on strategies.

Imagine: You’re the leader of a real estate team at a restaurant brand looking to open a new location in Manhattan. You have two options you’re evaluating: one site in SoHo, and another site in the Flatiron neighborhood. Which do you choose?

Keep Reading Show less
Enterprise

Arm’s new CEO is planning the IPO it sought to avoid last year

Arm CEO Rene Haas told Protocol that Arm will be fine as a standalone company, as it focuses on efficient computing and giving customers a more finished product than a basic chip core design.

Rene Haas is taking Arm on a fresh trajectory.

Photo: Arm

The new path for Arm is beginning to come into focus.

Weeks after Nvidia’s $40 bid to acquire Arm from SoftBank collapsed, the appointment of Rene Haas to replace longtime chief executive Simon Segars has set the business on a fresh trajectory. Haas appears determined to shake up the company, with plans to lay off as much as 15% of the staff ahead of plans to take the company public once again by the end of March next year.

Keep Reading Show less
Max A. Cherney

Max A. Cherney is a senior reporter at Protocol covering the semiconductor industry. He has worked for Barron's magazine as a Technology Reporter, and its sister site MarketWatch. He is based in San Francisco.

Policy

The great onshoring: Inside the transcontinental chip race

The second annual Trade and Technology Council emphasized the centrality of semiconductor onshoring to U.S.-EU military objectives.

For chip manufacturers, free-flowing subsidies for now might come at the cost of a potential overcapacity problem in the longer term.

Illustration: Christopher T. Fong/Protocol

The prospect of global conflict permeated the room at this year’s Trade and Technology Council, which concluded in France earlier this week. The second annual gathering of U.S. and EU officials yielded a joint statement that mentioned some form of “Russia” or “Ukraine” more frequently than “technology,” “regulation,” “investment,” “security” or “competition.”

The conflict in Ukraine, having already escalated into a U.S. proxy war, seemingly convinced the EU to fall in line with the American tech policy agenda.

Keep Reading Show less
Hirsh Chitkara

Hirsh Chitkara ( @HirshChitkara) is a reporter at Protocol focused on the intersection of politics, technology and society. Before joining Protocol, he helped write a daily newsletter at Insider that covered all things Big Tech. He's based in New York and can be reached at hchitkara@protocol.com.

Climate

2- and 3-wheelers dominate oil displacement by EVs

Increasingly widespread EV adoption is starting to displace the use of oil, but there's still a lot of work to do.

More electric mopeds on the road could be an oil demand game-changer.

Photo: Humphrey Muleba/Unsplash

Electric vehicles are starting to make a serious dent in oil use.

Last year, EVs displaced roughly 1.5 million barrels per day, according to a new analysis from BloombergNEF. That is more than double the share EVs displaced in 2015. The majority of the displacement is coming from an unlikely source.

Keep Reading Show less
Lisa Martine Jenkins

Lisa Martine Jenkins is a senior reporter at Protocol covering climate. Lisa previously wrote for Morning Consult, Chemical Watch and the Associated Press. Lisa is currently based in Brooklyn, and is originally from the Bay Area. Find her on Twitter ( @l_m_j_) or reach out via email (ljenkins@protocol.com).

Latest Stories
Bulletins