The Federal Trade Commission has kicked off the rulemaking process for privacy regulations that could restrict online surveillance and punish bad data-security practices. It's a move that some privacy advocates say is long overdue, as similar Congressional efforts face endless uncertainty.

The Advanced Notice of Proposed Rulemaking, approved on a 3-2 vote along partisan lines, was spurred by commercial data collection, which occurs at "a massive scale and in a stunning array of contexts," FTC Chair Lina M. Khan said in a press release. Companies surveil online activity, friend networks, browsing and purchase history, location data, and other details; analyze it with opaque algorithms; and sell it through "the massive, opaque market for consumer data," Khan said.

Companies can also fail to secure that data or use it to make services addictive to children. They can also potentially discriminate against customers based on legally protected statuses like race, gender, religion, and age, the FTC said. What's more, the release said, some companies make taking part in their "commercial surveillance" required for service or charge a premium to avoid it, employing dark patterns to keep the systems in place.

One of the three votes for the rulemaking came from Alvaro Bedoya, the founding director of Georgetown Law's Center on Privacy & Technology, who was appointed three months ago. Bedoya, who focused on unregulated facial recognition, has described privacy as a civil right.

This marks the first step in what could be a years-long, multi-administration effort by the FTC to act under its existing authority to regulate and enforce privacy protections. The Industry Association of Privacy Professionals said that, should the FTC work under its Magnuson-Moss, or "warranty," authority, it faces "a lengthy process that can take several years to complete." The FTC gave no indication of a timeline for enacting a final rule, though it's unlikely to come before the end of this year.

Advertisement

Both critics and supporters want to see Congress act, too

The FTC is seeking input from stakeholders and the public, starting with a public forum on September 8. Before the announcement was a day old, however, many organizations issued statements on the move.

Consumer Reports (CR) had effusive praise for the regulatory agency seeking to do some regulating. "While we continue to support federal and state efforts to enact and enforce comprehensive privacy legislation, consumers can wait no longer to have their personal information protected," Justin Brookman, director of technology policy at CR, said in a release. "The FTC has the authority to issue clear rules to safeguard personal data by holding companies accountable for unwanted data collection, use, and disclosure."

CR was one of more than 40 organizations that urged the FTC to act on data privacy in 2021, including the American Civil Liberties Union, the Electronic Frontier Foundation, and Public Knowledge.

Energy and Commerce Chairman Frank Pallone, Jr. (D-NJ) said in a release that while the lack of online privacy in the US is "completely unacceptable," the FTC shouldn't be stuck with only its existing authority to deal with it. Pallone pushed his American Data Privacy and Protection Act, which would broaden the FTC's authority to create and enforce data protections. That bill has cleared a key House committee, but it awaits an uncertain floor vote and even tougher Senate future.

Senator Edward J. Markey (D-Mass.), meanwhile, believes that his own Children and Teens' Online Privacy Protection Act is the best, if narrowest, way forward. The bill would create a Youth Privacy and Marketing Division at the FTC that focuses on protections for those 16 and younger.

Both Republican commissioners on the FTC would be fine with deferring privacy to Congress. Christine Wilson and Noah Phillips cited privacy laws that are seemingly moving ahead and the vast implications of any FTC action. Phillips said an FTC privacy action "will impact many thousands of companies, millions of citizens, and billions upon billions of dollars in commerce."