Policy

The FTC's next privacy move is a dangerous game years in the making

Tech's de facto regulator has been taking half measures for decades as Congress fails on data protection. That might soon change.

FTC chair Lina Khan

The FTC has been clearing the way to issue more rules governing whole industries.

Photo: Graeme Jennings/AFP via Getty Images

After many years of "concerns" and false starts, the FTC appears poised to tell tech companies what they must do — and stop doing — to protect consumer privacy.

Crafting actual privacy rules is an ambitious undertaking that has eluded Congress for more than a decade. But the FTC, under new chair Lina Khan, seems ready to regulate most of the digital services industry and a good chunk of the "offline" world to boot. If history's any guide, any move is sure to spur furious pushback that could endanger even the FTC's basic powers.

It's also something that Khan and the other two Democrats on the commission have been readying for months, after years of half-measures by the agency charged by default with regulating Big Tech.

The Wall Street Journal reports that the commission is considering opening a new rulemaking procedure, likely using its authority to regulate specific "unfair or deceptive acts." The new rules would allow the commission to act without waiting for Congress to decide on an approach for certain fraught issues, such as whether tech platforms should face consumer lawsuits for privacy violations.

"There are now some pretty good indications that the Federal Trade Commission is going to have, or begin, rulemaking on privacy," said Sen. Richard Blumenthal, who led Democratic colleagues in a letter urging a rulemaking in September, during a hearing soon after the Journal report. "This development would be very, very welcome."

New, privacy-specific rules would be a far cry from how the FTC has dealt with Big Tech's practices in the past. For the history of modern tech as we know it, the agency's approach has been a narrow one. Essentially, the FTC has focused on a few high-profile companies that appeared to be lying to users about their privacy practices, then reached settlements with those firms saying they could face large fines for future violations where a company's actions didn't match its consumer-facing statements. If one of those companies was later found to be violating the terms of those settlements, the FTC was then able to extract actual money — such as the agency's $5 billion total fine on Facebook in the wake of the Cambridge Analytica scandal — and promises of future better behavior.

That emphasis on repeat offenders is written into the law, but the focus on the worst conduct from the biggest players is an outgrowth of budget constraints. To the FTC's credit, chairs from both parties have long sought the ability to punish companies the first time they break the law, as well as for more resources from Congress.

But until now, the idea of the FTC forcing the whole industry to abide by privacy rules appeared to be unfathomable, outside of children's privacy. As recently as last year, an in-house FTC report called the commission's rulemaking powers, which are more time-consuming than other agencies', "an imperfect tool for the rapidly evolving space of data privacy." The FTC pleaded for Congress to do the work that voters demanded — maybe giving the agency some expedited power to adjust technical definitions in the process — but commission leadership essentially ignored the possibility that it could take over the whole project.

That appears to have changed in recent months. Even one of the FTC's Republican commissioners, Christine Wilson, testified before Congress in July that she "had become more receptive" to FTC rulemaking on privacy "to address the information asymmetry between the providers of goods and services and their users," though she also said her doubts had grown again because of how Khan has run the commission.

Advocates of FTC-only action largely still would prefer that Congress take the lead, but they're increasingly unwilling to wait around for lawmakers to pass a bill.

"Congress just hasn't done its job," Justin Brookman, head of tech policy for Consumer Reports, said in a tweet. He cited a failed privacy bill from the year 2000 to make his point, calling for the FTC to jump into the rulemaking process.

Blumenthal likewise said Congress had "failed abjectly to fulfill its responsibility" and said "the FTC is supposed to fill gaps," such as the absence of broad federal privacy rules.

Laying the groundwork

Within her first few weeks as chair, Khan, a vocal tech skeptic, began to clear a path so the FTC wouldn't have to wait much longer. In July, during the first of the public meetings that she instituted, Khan and the Democrats voted to streamline the FTC's procedure for rulemaking, although it remains particularly cumbersome. Her fellow Democratic commissioner Rebecca Kelly Slaughter, who had pushed for more rulemaking before Khan joined the commission, argued during the meeting that Congress' grant of regulatory authority sent "a clear directive to the FTC to promulgate trade rules to protect consumers in the dynamic and changing economic landscape."

When the FTC voted to streamline its rulemaking in July, it also moved to broaden its powers to police "unfair methods of competition," and floated the possibility of new rules on the issue. And Congress is considering $1 billion for a privacy bureau at the FTC.

Shortly after Khan took over as chair, President Joe Biden issued an order urging the FTC to tackle competition, including attention to "unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy."

Since then, Khan has also made clear her first task as chair is to understand not just what tech companies want to talk about, but the underlying business models and incentives that truly drive them, such as Facebook's roaring advertising business that sucks up so much user data.

Biden in September also nominated privacy hawk Alvaro Bedoya to join the commission, now that Democrat Rohit Chopra is leaving to head up the Consumer Financial Protection Bureau. Accountable Tech, a Democratic-allied group that's been critical of the industry, also recently formally petitioned for rulemaking on "surveillance advertising" — casting the technology that powers Big Tech companies like Google as a threat to competition.

Despite this seemingly broad support, however, any FTC effort will face plenty of headwinds. The potential avenues for regulating privacy are immense, ranging from ads and children's privacy to connected devices' listening techniques, health apps, data brokers, the civil rights implications of algorithms, computer hacks and even the competitive dynamics affecting privacy. Brick-and-mortar retailers have even become enmeshed in online privacy debates if they have ecommerce sites. Each of these issues, by itself, has stymied the commission for years — let alone any attempt to roll them up together.

The opposition is also coming from inside the house. In a joint opinion piece on Wednesday, the FTC's other Republican commissioner, Noah Phillips, and two top Republican lawmakers who have been working on privacy legislation called any potential privacy rulemaking "blatant overreach that would almost certainly invite legal challenges."

"The legislative process may be slower than some would prefer, but that is no basis for executive agencies to usurp the people's elected representatives and the powers granted them by the Constitution," wrote Phillips, Sen. Roger Wicker, and Rep. Cathy McMorris Rodgers.

Litigation could tie up any new rules up for years, but from the commission's perspective it may be the lesser evil as compared to drawing ire from Congress. Critics of FTC inaction trace the agency's timidity to the 1980s. At the time, many saw the FTC's attempts to regulate children's advertising as the height of nanny-state overreach, in part thanks to a campaign by advertisers. In response to "kidvid," Congress reined in the agency's regulatory powers — and in the process taught generations of FTC staff to tiptoe around lawmakers.

It's a cycle that's recurred throughout FTC's existence, and Khan, who loves the agency's history, has made clear she's well aware of it.

Her colleagues, too, seem well aware that the clock is ticking: In a speech earlier in October, Slaughter discussed online ads and pushed the idea that companies should only collect data necessary for their offerings.

"I am confident that it is time for us to start asking the questions and developing the record, before the practices about which we are concerned become even more entrenched," she said. "The market is changing whether we promulgate rules or not."

A MESSAGE FROM ALIBABA

www.protocol.com

The future of retail is digital, experiential – and happening now in China. U.S. businesses are going digital and using Alibaba to create immersive experiences to sell to the 900 million Chinese consumers on Alibaba's ecommerce platforms.

LEARN MORE

Enterprise

Why foundation models in AI need to be released responsibly

Foundation models like GPT-3 and DALL-E are changing AI forever. We urgently need to develop community norms that guarantee research access and help guide the future of AI responsibly.

Releasing new foundation models doesn’t have to be an all or nothing proposition.

Illustration: sorbetto/DigitalVision Vectors

Percy Liang is director of the Center for Research on Foundation Models, a faculty affiliate at the Stanford Institute for Human-Centered AI and an associate professor of Computer Science at Stanford University.

Humans are not very good at forecasting the future, especially when it comes to technology.

Keep Reading Show less
Percy Liang
Percy Liang is Director of the Center for Research on Foundation Models, a Faculty Affiliate at the Stanford Institute for Human-Centered AI, and an Associate Professor of Computer Science at Stanford University.

Every day, millions of us press the “order” button on our favorite coffee store's mobile application: Our chosen brew will be on the counter when we arrive. It’s a personalized, seamless experience that we have all come to expect. What we don’t know is what’s happening behind the scenes. The mobile application is sourcing data from a database that stores information about each customer and what their favorite coffee drinks are. It is also leveraging event-streaming data in real time to ensure the ingredients for your personal coffee are in supply at your local store.

Applications like this power our daily lives, and if they can’t access massive amounts of data stored in a database as well as stream data “in motion” instantaneously, you — and millions of customers — won’t have these in-the-moment experiences.

Keep Reading Show less
Jennifer Goforth Gregory
Jennifer Goforth Gregory has worked in the B2B technology industry for over 20 years. As a freelance writer she writes for top technology brands, including IBM, HPE, Adobe, AT&T, Verizon, Epson, Oracle, Intel and Square. She specializes in a wide range of technology, such as AI, IoT, cloud, cybersecurity, and CX. Jennifer also wrote a bestselling book The Freelance Content Marketing Writer to help other writers launch a high earning freelance business.
Climate

The West’s drought could bring about a data center reckoning

When it comes to water use, data centers are the tech industry’s secret water hogs — and they could soon come under increased scrutiny.

Lake Mead, North America's largest artificial reservoir, has dropped to about 1,052 feet above sea level, the lowest it's been since being filled in 1937.

Photo: Mario Tama/Getty Images

The West is parched, and getting more so by the day. Lake Mead — the country’s largest reservoir — is nearing “dead pool” levels, meaning it may soon be too low to flow downstream. The entirety of the Four Corners plus California is mired in megadrought.

Amid this desiccation, hundreds of the country’s data centers use vast amounts of water to hum along. Dozens cluster around major metro centers, including those with mandatory or voluntary water restrictions in place to curtail residential and agricultural use.

Keep Reading Show less
Lisa Martine Jenkins

Lisa Martine Jenkins is a senior reporter at Protocol covering climate. Lisa previously wrote for Morning Consult, Chemical Watch and the Associated Press. Lisa is currently based in Brooklyn, and is originally from the Bay Area. Find her on Twitter ( @l_m_j_) or reach out via email (ljenkins@protocol.com).

Workplace

Indeed is hiring 4,000 workers despite industry layoffs

Indeed’s new CPO, Priscilla Koranteng, spoke to Protocol about her first 100 days in the role and the changing nature of HR.

"[Y]ou are serving the people. And everything that's happening around us in the world is … impacting their professional lives."

Image: Protocol

Priscilla Koranteng's plans are ambitious. Koranteng, who was appointed chief people officer of Indeed in June, has already enhanced the company’s abortion travel policies and reinforced its goal to hire 4,000 people in 2022.

She’s joined the HR tech company in a time when many other tech companies are enacting layoffs and cutbacks, but said she sees this precarious time as an opportunity for growth companies to really get ahead. Koranteng, who comes from an HR and diversity VP role at Kellogg, is working on embedding her hybrid set of expertise in her new role at Indeed.

Keep Reading Show less
Amber Burton

Amber Burton (@amberbburton) is a reporter at Protocol. Previously, she covered personal finance and diversity in business at The Wall Street Journal. She earned an M.S. in Strategic Communications from Columbia University and B.A. in English and Journalism from Wake Forest University. She lives in North Carolina.

Climate

New Jersey could become an ocean energy hub

A first-in-the-nation bill would support wave and tidal energy as a way to meet the Garden State's climate goals.

Technological challenges mean wave and tidal power remain generally more expensive than their other renewable counterparts. But government support could help spur more innovation that brings down cost.

Photo: Jeremy Bishop via Unsplash

Move over, solar and wind. There’s a new kid on the renewable energy block: waves and tides.

Harnessing the ocean’s power is still in its early stages, but the industry is poised for a big legislative boost, with the potential for real investment down the line.

Keep Reading Show less
Lisa Martine Jenkins

Lisa Martine Jenkins is a senior reporter at Protocol covering climate. Lisa previously wrote for Morning Consult, Chemical Watch and the Associated Press. Lisa is currently based in Brooklyn, and is originally from the Bay Area. Find her on Twitter ( @l_m_j_) or reach out via email (ljenkins@protocol.com).

Latest Stories
Bulletins