Policy

The FTC's next privacy move is a dangerous game years in the making

Tech's de facto regulator has been taking half measures for decades as Congress fails on data protection. That might soon change.

FTC chair Lina Khan

The FTC has been clearing the way to issue more rules governing whole industries.

Photo: Graeme Jennings/AFP via Getty Images

After many years of "concerns" and false starts, the FTC appears poised to tell tech companies what they must do — and stop doing — to protect consumer privacy.

Crafting actual privacy rules is an ambitious undertaking that has eluded Congress for more than a decade. But the FTC, under new chair Lina Khan, seems ready to regulate most of the digital services industry and a good chunk of the "offline" world to boot. If history's any guide, any move is sure to spur furious pushback that could endanger even the FTC's basic powers.

It's also something that Khan and the other two Democrats on the commission have been readying for months, after years of half-measures by the agency charged by default with regulating Big Tech.

The Wall Street Journal reports that the commission is considering opening a new rulemaking procedure, likely using its authority to regulate specific "unfair or deceptive acts." The new rules would allow the commission to act without waiting for Congress to decide on an approach for certain fraught issues, such as whether tech platforms should face consumer lawsuits for privacy violations.

"There are now some pretty good indications that the Federal Trade Commission is going to have, or begin, rulemaking on privacy," said Sen. Richard Blumenthal, who led Democratic colleagues in a letter urging a rulemaking in September, during a hearing soon after the Journal report. "This development would be very, very welcome."

New, privacy-specific rules would be a far cry from how the FTC has dealt with Big Tech's practices in the past. For the history of modern tech as we know it, the agency's approach has been a narrow one. Essentially, the FTC has focused on a few high-profile companies that appeared to be lying to users about their privacy practices, then reached settlements with those firms saying they could face large fines for future violations where a company's actions didn't match its consumer-facing statements. If one of those companies was later found to be violating the terms of those settlements, the FTC was then able to extract actual money — such as the agency's $5 billion total fine on Facebook in the wake of the Cambridge Analytica scandal — and promises of future better behavior.

That emphasis on repeat offenders is written into the law, but the focus on the worst conduct from the biggest players is an outgrowth of budget constraints. To the FTC's credit, chairs from both parties have long sought the ability to punish companies the first time they break the law, as well as for more resources from Congress.

But until now, the idea of the FTC forcing the whole industry to abide by privacy rules appeared to be unfathomable, outside of children's privacy. As recently as last year, an in-house FTC report called the commission's rulemaking powers, which are more time-consuming than other agencies', "an imperfect tool for the rapidly evolving space of data privacy." The FTC pleaded for Congress to do the work that voters demanded — maybe giving the agency some expedited power to adjust technical definitions in the process — but commission leadership essentially ignored the possibility that it could take over the whole project.

That appears to have changed in recent months. Even one of the FTC's Republican commissioners, Christine Wilson, testified before Congress in July that she "had become more receptive" to FTC rulemaking on privacy "to address the information asymmetry between the providers of goods and services and their users," though she also said her doubts had grown again because of how Khan has run the commission.

Advocates of FTC-only action largely still would prefer that Congress take the lead, but they're increasingly unwilling to wait around for lawmakers to pass a bill.

"Congress just hasn't done its job," Justin Brookman, head of tech policy for Consumer Reports, said in a tweet. He cited a failed privacy bill from the year 2000 to make his point, calling for the FTC to jump into the rulemaking process.

Blumenthal likewise said Congress had "failed abjectly to fulfill its responsibility" and said "the FTC is supposed to fill gaps," such as the absence of broad federal privacy rules.

Laying the groundwork

Within her first few weeks as chair, Khan, a vocal tech skeptic, began to clear a path so the FTC wouldn't have to wait much longer. In July, during the first of the public meetings that she instituted, Khan and the Democrats voted to streamline the FTC's procedure for rulemaking, although it remains particularly cumbersome. Her fellow Democratic commissioner Rebecca Kelly Slaughter, who had pushed for more rulemaking before Khan joined the commission, argued during the meeting that Congress' grant of regulatory authority sent "a clear directive to the FTC to promulgate trade rules to protect consumers in the dynamic and changing economic landscape."

When the FTC voted to streamline its rulemaking in July, it also moved to broaden its powers to police "unfair methods of competition," and floated the possibility of new rules on the issue. And Congress is considering $1 billion for a privacy bureau at the FTC.

Shortly after Khan took over as chair, President Joe Biden issued an order urging the FTC to tackle competition, including attention to "unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy."

Since then, Khan has also made clear her first task as chair is to understand not just what tech companies want to talk about, but the underlying business models and incentives that truly drive them, such as Facebook's roaring advertising business that sucks up so much user data.

Biden in September also nominated privacy hawk Alvaro Bedoya to join the commission, now that Democrat Rohit Chopra is leaving to head up the Consumer Financial Protection Bureau. Accountable Tech, a Democratic-allied group that's been critical of the industry, also recently formally petitioned for rulemaking on "surveillance advertising" — casting the technology that powers Big Tech companies like Google as a threat to competition.

Despite this seemingly broad support, however, any FTC effort will face plenty of headwinds. The potential avenues for regulating privacy are immense, ranging from ads and children's privacy to connected devices' listening techniques, health apps, data brokers, the civil rights implications of algorithms, computer hacks and even the competitive dynamics affecting privacy. Brick-and-mortar retailers have even become enmeshed in online privacy debates if they have ecommerce sites. Each of these issues, by itself, has stymied the commission for years — let alone any attempt to roll them up together.

The opposition is also coming from inside the house. In a joint opinion piece on Wednesday, the FTC's other Republican commissioner, Noah Phillips, and two top Republican lawmakers who have been working on privacy legislation called any potential privacy rulemaking "blatant overreach that would almost certainly invite legal challenges."

"The legislative process may be slower than some would prefer, but that is no basis for executive agencies to usurp the people's elected representatives and the powers granted them by the Constitution," wrote Phillips, Sen. Roger Wicker, and Rep. Cathy McMorris Rodgers.

Litigation could tie up any new rules up for years, but from the commission's perspective it may be the lesser evil as compared to drawing ire from Congress. Critics of FTC inaction trace the agency's timidity to the 1980s. At the time, many saw the FTC's attempts to regulate children's advertising as the height of nanny-state overreach, in part thanks to a campaign by advertisers. In response to "kidvid," Congress reined in the agency's regulatory powers — and in the process taught generations of FTC staff to tiptoe around lawmakers.

It's a cycle that's recurred throughout FTC's existence, and Khan, who loves the agency's history, has made clear she's well aware of it.

Her colleagues, too, seem well aware that the clock is ticking: In a speech earlier in October, Slaughter discussed online ads and pushed the idea that companies should only collect data necessary for their offerings.

"I am confident that it is time for us to start asking the questions and developing the record, before the practices about which we are concerned become even more entrenched," she said. "The market is changing whether we promulgate rules or not."

A MESSAGE FROM ALIBABA

www.protocol.com

The future of retail is digital, experiential – and happening now in China. U.S. businesses are going digital and using Alibaba to create immersive experiences to sell to the 900 million Chinese consumers on Alibaba's ecommerce platforms.

LEARN MORE

Entertainment

Fortnite’s Dragon Ball Z event is too good to skip

Don’t know what to do this weekend? We’ve got you covered.

Our recommendations for your weekend.

Image: Hulu; Epic Games; New York Magazine

Summer’s almost over, but there’s still time to check out some content. This week we’re excited to play Fortnite’s Dragon Ball Z event; “Prey” on Hulu includes some award-winning performances; and we can’t wait to spend the weekend with the comically sinister Cult of the Lamb.

Keep Reading Show less
Nick Statt

Nick Statt is Protocol's video game reporter. Prior to joining Protocol, he was news editor at The Verge covering the gaming industry, mobile apps and antitrust out of San Francisco, in addition to managing coverage of Silicon Valley tech giants and startups. He now resides in Rochester, New York, home of the garbage plate and, completely coincidentally, the World Video Game Hall of Fame. He can be reached at nstatt@protocol.com.

As management teams at financial institutions look for best practices to make part of their regular toolkit, they are reaching most for the ones that increase the speed and reduce the risk of large-scale change.

That forward-thinking approach can lead financial institutions to leverage AI technology, which can help give decision-makers trusted tools to solve integral challenges vital to the health of the business. One of the leading providers of AI and machine-learning software, DataRobot continues to attract clients in financial services who want to de-risk their AI investments and rapidly scale AI to almost every part of their operations, resulting in improved productivity and higher customer satisfaction.

Keep Reading Show less
David Silverberg
David Silverberg is a Toronto-based freelance journalist, editor and writing coach. He writes for The Washington Post, BBC News, Business Insider, The Toronto Star, New Scientist, Fodor's, and several alumni magazines. He also writes for brands such as 23andme, Shopify and Bold Commerce. He has served as editor of B2B News Network, Canada's only B2B news magazine, and Digital Journal, a leading pioneer in citizen journalism. Find more about him at www.davidsilverberg.ca
Climate

How Indiana's $100 million EV plan sidelines Black communities

Advocates are asking the federal government to block the plan so Indiana will come back to the bargaining table.

Indiana's EV plan might not benefit all its citizens.

Photo: Victor J. Blue/Bloomberg via Getty Images

Thanks to the Bipartisan Infrastructure Law, the state of Indiana is set to receive $100 million to build out a network of electric vehicle charging stations by 2025. But local officials and leaders of the NAACP in the state are calling on the Biden administration to reject the state’s plan, arguing that communities of color have been left out of the planning process, leading to a proposal that could entrench the racist transportation policies that both President Biden and Transportation Secretary Pete Buttigieg have vowed to address with these new federal funds.

"The state of Indiana has created a plan that is not equitable for communities of color, Black and brown,” said Henry Davis Jr., a city council member in South Bend, where Buttigieg was mayor. “We want to be included in that plan. It is kind of hard to be included on a plan when you are not even at the table.”

Keep Reading Show less
Kwasi Gyamfi Asiedu

Kwasi (kway-see) is a fellow at Protocol with an interest in tech policy and climate. Previously, he covered global religion news at the Associated Press in New York. Before that, he was a freelance journalist based out of Accra, Ghana, covering social justice, health, and environment stories. His reporting has been published in The New York Times, Quartz, CNN, The Guardian, and Public Radio International. He can be reached at kasiedu@protocol.com.

Policy

Why tech shrugged off the new 15% corporate minimum tax

The corporate minimum tax law passed, but the battle of some key provisions is just getting started.

The long-awaited corporate tax reform should in theory be a big deal, but markets hardly flinched after it became clear the Inflation Reduction Act would pass.

Photo illustration: Christopher T. Fong/Protocol; Unsplash

When President Biden signed the Inflation Reduction Act into law on Wednesday, he put in place a 15% minimum tax rate for all large U.S. corporations.

The long-awaited corporate tax reform should in theory be a big deal, but markets hardly flinched after it became clear the legislation would pass. And tech companies — which pulled out all the stops to hinder Sen. Amy Klobuchar’s antitrust bill — hardly resisted the measure, even if their interest groups dutifully issued statements of opposition. Tim Cook didn’t swing by D.C., there were no mass fly-ins and no casting calls went out for the part of Joe America in stilted political attack ads.

Keep Reading Show less
Hirsh Chitkara

Hirsh Chitkara ( @HirshChitkara) is a reporter at Protocol focused on the intersection of politics, technology and society. Before joining Protocol, he helped write a daily newsletter at Insider that covered all things Big Tech. He's based in New York and can be reached at hchitkara@protocol.com.

Climate

How GM plans to make its ambitious EV goals reality

The automaker's chief sustainability officer is optimistic that GM is well-positioned to rapidly scale up the EV side of its business.

"I think everything that’s been put in place to support the transition will be a real positive for the industry and for the country."

Photo: Eva Marie Uzcategui/Bloomberg via Getty Images

Automakers are on the cusp of an entirely new era.

The transition to electric vehicles is quickly becoming more than just theoretical: More models are coming onto the scene every day. This week, the Inflation Reduction Act was signed into law, enshrining a new structure for EV tax credits and offering a boost to domestic critical mineral mining. The transition isn’t coming a moment too soon, given that the transportation sector makes up the largest share of greenhouse gas emissions in the U.S.

Keep Reading Show less
Lisa Martine Jenkins

Lisa Martine Jenkins is a senior reporter at Protocol covering climate. Lisa previously wrote for Morning Consult, Chemical Watch and the Associated Press. Lisa is currently based in Brooklyn, and is originally from the Bay Area. Find her on Twitter ( @l_m_j_) or reach out via email (ljenkins@protocol.com).

Latest Stories
Bulletins