Policy

The FTC's next privacy move is a dangerous game years in the making

Tech's de facto regulator has been taking half measures for decades as Congress fails on data protection. That might soon change.

FTC chair Lina Khan

The FTC has been clearing the way to issue more rules governing whole industries.

Photo: Graeme Jennings/AFP via Getty Images

After many years of "concerns" and false starts, the FTC appears poised to tell tech companies what they must do — and stop doing — to protect consumer privacy.

Crafting actual privacy rules is an ambitious undertaking that has eluded Congress for more than a decade. But the FTC, under new chair Lina Khan, seems ready to regulate most of the digital services industry and a good chunk of the "offline" world to boot. If history's any guide, any move is sure to spur furious pushback that could endanger even the FTC's basic powers.

It's also something that Khan and the other two Democrats on the commission have been readying for months, after years of half-measures by the agency charged by default with regulating Big Tech.

The Wall Street Journal reports that the commission is considering opening a new rulemaking procedure, likely using its authority to regulate specific "unfair or deceptive acts." The new rules would allow the commission to act without waiting for Congress to decide on an approach for certain fraught issues, such as whether tech platforms should face consumer lawsuits for privacy violations.

"There are now some pretty good indications that the Federal Trade Commission is going to have, or begin, rulemaking on privacy," said Sen. Richard Blumenthal, who led Democratic colleagues in a letter urging a rulemaking in September, during a hearing soon after the Journal report. "This development would be very, very welcome."

New, privacy-specific rules would be a far cry from how the FTC has dealt with Big Tech's practices in the past. For the history of modern tech as we know it, the agency's approach has been a narrow one. Essentially, the FTC has focused on a few high-profile companies that appeared to be lying to users about their privacy practices, then reached settlements with those firms saying they could face large fines for future violations where a company's actions didn't match its consumer-facing statements. If one of those companies was later found to be violating the terms of those settlements, the FTC was then able to extract actual money — such as the agency's $5 billion total fine on Facebook in the wake of the Cambridge Analytica scandal — and promises of future better behavior.

That emphasis on repeat offenders is written into the law, but the focus on the worst conduct from the biggest players is an outgrowth of budget constraints. To the FTC's credit, chairs from both parties have long sought the ability to punish companies the first time they break the law, as well as for more resources from Congress.

But until now, the idea of the FTC forcing the whole industry to abide by privacy rules appeared to be unfathomable, outside of children's privacy. As recently as last year, an in-house FTC report called the commission's rulemaking powers, which are more time-consuming than other agencies', "an imperfect tool for the rapidly evolving space of data privacy." The FTC pleaded for Congress to do the work that voters demanded — maybe giving the agency some expedited power to adjust technical definitions in the process — but commission leadership essentially ignored the possibility that it could take over the whole project.

That appears to have changed in recent months. Even one of the FTC's Republican commissioners, Christine Wilson, testified before Congress in July that she "had become more receptive" to FTC rulemaking on privacy "to address the information asymmetry between the providers of goods and services and their users," though she also said her doubts had grown again because of how Khan has run the commission.

Advocates of FTC-only action largely still would prefer that Congress take the lead, but they're increasingly unwilling to wait around for lawmakers to pass a bill.

"Congress just hasn't done its job," Justin Brookman, head of tech policy for Consumer Reports, said in a tweet. He cited a failed privacy bill from the year 2000 to make his point, calling for the FTC to jump into the rulemaking process.

Blumenthal likewise said Congress had "failed abjectly to fulfill its responsibility" and said "the FTC is supposed to fill gaps," such as the absence of broad federal privacy rules.

Laying the groundwork

Within her first few weeks as chair, Khan, a vocal tech skeptic, began to clear a path so the FTC wouldn't have to wait much longer. In July, during the first of the public meetings that she instituted, Khan and the Democrats voted to streamline the FTC's procedure for rulemaking, although it remains particularly cumbersome. Her fellow Democratic commissioner Rebecca Kelly Slaughter, who had pushed for more rulemaking before Khan joined the commission, argued during the meeting that Congress' grant of regulatory authority sent "a clear directive to the FTC to promulgate trade rules to protect consumers in the dynamic and changing economic landscape."

When the FTC voted to streamline its rulemaking in July, it also moved to broaden its powers to police "unfair methods of competition," and floated the possibility of new rules on the issue. And Congress is considering $1 billion for a privacy bureau at the FTC.

Shortly after Khan took over as chair, President Joe Biden issued an order urging the FTC to tackle competition, including attention to "unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy."

Since then, Khan has also made clear her first task as chair is to understand not just what tech companies want to talk about, but the underlying business models and incentives that truly drive them, such as Facebook's roaring advertising business that sucks up so much user data.

Biden in September also nominated privacy hawk Alvaro Bedoya to join the commission, now that Democrat Rohit Chopra is leaving to head up the Consumer Financial Protection Bureau. Accountable Tech, a Democratic-allied group that's been critical of the industry, also recently formally petitioned for rulemaking on "surveillance advertising" — casting the technology that powers Big Tech companies like Google as a threat to competition.

Despite this seemingly broad support, however, any FTC effort will face plenty of headwinds. The potential avenues for regulating privacy are immense, ranging from ads and children's privacy to connected devices' listening techniques, health apps, data brokers, the civil rights implications of algorithms, computer hacks and even the competitive dynamics affecting privacy. Brick-and-mortar retailers have even become enmeshed in online privacy debates if they have ecommerce sites. Each of these issues, by itself, has stymied the commission for years — let alone any attempt to roll them up together.

The opposition is also coming from inside the house. In a joint opinion piece on Wednesday, the FTC's other Republican commissioner, Noah Phillips, and two top Republican lawmakers who have been working on privacy legislation called any potential privacy rulemaking "blatant overreach that would almost certainly invite legal challenges."

"The legislative process may be slower than some would prefer, but that is no basis for executive agencies to usurp the people's elected representatives and the powers granted them by the Constitution," wrote Phillips, Sen. Roger Wicker, and Rep. Cathy McMorris Rodgers.

Litigation could tie up any new rules up for years, but from the commission's perspective it may be the lesser evil as compared to drawing ire from Congress. Critics of FTC inaction trace the agency's timidity to the 1980s. At the time, many saw the FTC's attempts to regulate children's advertising as the height of nanny-state overreach, in part thanks to a campaign by advertisers. In response to "kidvid," Congress reined in the agency's regulatory powers — and in the process taught generations of FTC staff to tiptoe around lawmakers.

It's a cycle that's recurred throughout FTC's existence, and Khan, who loves the agency's history, has made clear she's well aware of it.

Her colleagues, too, seem well aware that the clock is ticking: In a speech earlier in October, Slaughter discussed online ads and pushed the idea that companies should only collect data necessary for their offerings.

"I am confident that it is time for us to start asking the questions and developing the record, before the practices about which we are concerned become even more entrenched," she said. "The market is changing whether we promulgate rules or not."

A MESSAGE FROM ALIBABA

www.protocol.com

The future of retail is digital, experiential – and happening now in China. U.S. businesses are going digital and using Alibaba to create immersive experiences to sell to the 900 million Chinese consumers on Alibaba's ecommerce platforms.

LEARN MORE

Fintech

Judge Zia Faruqui is trying to teach you crypto, one ‘SNL’ reference at a time

His decisions on major cryptocurrency cases have quoted "The Big Lebowski," "SNL," and "Dr. Strangelove." That’s because he wants you — yes, you — to read them.

The ways Zia Faruqui (right) has weighed on cases that have come before him can give lawyers clues as to what legal frameworks will pass muster.

Photo: Carolyn Van Houten/The Washington Post via Getty Images

“Cryptocurrency and related software analytics tools are ‘The wave of the future, Dude. One hundred percent electronic.’”

That’s not a quote from "The Big Lebowski" — at least, not directly. It’s a quote from a Washington, D.C., district court memorandum opinion on the role cryptocurrency analytics tools can play in government investigations. The author is Magistrate Judge Zia Faruqui.

Keep Reading Show less
Veronica Irwin

Veronica Irwin (@vronirwin) is a San Francisco-based reporter at Protocol covering fintech. Previously she was at the San Francisco Examiner, covering tech from a hyper-local angle. Before that, her byline was featured in SF Weekly, The Nation, Techworker, Ms. Magazine and The Frisc.

The financial technology transformation is driving competition, creating consumer choice, and shaping the future of finance. Hear from seven fintech leaders who are reshaping the future of finance, and join the inaugural Financial Technology Association Fintech Summit to learn more.

Keep Reading Show less
FTA
The Financial Technology Association (FTA) represents industry leaders shaping the future of finance. We champion the power of technology-centered financial services and advocate for the modernization of financial regulation to support inclusion and responsible innovation.
Enterprise

AWS CEO: The cloud isn’t just about technology

As AWS preps for its annual re:Invent conference, Adam Selipsky talks product strategy, support for hybrid environments, and the value of the cloud in uncertain economic times.

Photo: Noah Berger/Getty Images for Amazon Web Services

AWS is gearing up for re:Invent, its annual cloud computing conference where announcements this year are expected to focus on its end-to-end data strategy and delivering new industry-specific services.

It will be the second re:Invent with CEO Adam Selipsky as leader of the industry’s largest cloud provider after his return last year to AWS from data visualization company Tableau Software.

Keep Reading Show less
Donna Goodison

Donna Goodison (@dgoodison) is Protocol's senior reporter focusing on enterprise infrastructure technology, from the 'Big 3' cloud computing providers to data centers. She previously covered the public cloud at CRN after 15 years as a business reporter for the Boston Herald. Based in Massachusetts, she also has worked as a Boston Globe freelancer, business reporter at the Boston Business Journal and real estate reporter at Banker & Tradesman after toiling at weekly newspapers.

Image: Protocol

We launched Protocol in February 2020 to cover the evolving power center of tech. It is with deep sadness that just under three years later, we are winding down the publication.

As of today, we will not publish any more stories. All of our newsletters, apart from our flagship, Source Code, will no longer be sent. Source Code will be published and sent for the next few weeks, but it will also close down in December.

Keep Reading Show less
Bennett Richardson

Bennett Richardson ( @bennettrich) is the president of Protocol. Prior to joining Protocol in 2019, Bennett was executive director of global strategic partnerships at POLITICO, where he led strategic growth efforts including POLITICO's European expansion in Brussels and POLITICO's creative agency POLITICO Focus during his six years with the company. Prior to POLITICO, Bennett was co-founder and CMO of Hinge, the mobile dating company recently acquired by Match Group. Bennett began his career in digital and social brand marketing working with major brands across tech, energy, and health care at leading marketing and communications agencies including Edelman and GMMB. Bennett is originally from Portland, Maine, and received his bachelor's degree from Colgate University.

Enterprise

Why large enterprises struggle to find suitable platforms for MLops

As companies expand their use of AI beyond running just a few machine learning models, and as larger enterprises go from deploying hundreds of models to thousands and even millions of models, ML practitioners say that they have yet to find what they need from prepackaged MLops systems.

As companies expand their use of AI beyond running just a few machine learning models, ML practitioners say that they have yet to find what they need from prepackaged MLops systems.

Photo: artpartner-images via Getty Images

On any given day, Lily AI runs hundreds of machine learning models using computer vision and natural language processing that are customized for its retail and ecommerce clients to make website product recommendations, forecast demand, and plan merchandising. But this spring when the company was in the market for a machine learning operations platform to manage its expanding model roster, it wasn’t easy to find a suitable off-the-shelf system that could handle such a large number of models in deployment while also meeting other criteria.

Some MLops platforms are not well-suited for maintaining even more than 10 machine learning models when it comes to keeping track of data, navigating their user interfaces, or reporting capabilities, Matthew Nokleby, machine learning manager for Lily AI’s product intelligence team, told Protocol earlier this year. “The duct tape starts to show,” he said.

Keep Reading Show less
Kate Kaye

Kate Kaye is an award-winning multimedia reporter digging deep and telling print, digital and audio stories. She covers AI and data for Protocol. Her reporting on AI and tech ethics issues has been published in OneZero, Fast Company, MIT Technology Review, CityLab, Ad Age and Digiday and heard on NPR. Kate is the creator of RedTailMedia.org and is the author of "Campaign '08: A Turning Point for Digital Media," a book about how the 2008 presidential campaigns used digital media and data.

Latest Stories
Bulletins