The Federal Trade Commission is working on new internet privacy rules affecting the gathering, analyzing and selling of people’s data rather than waiting for Congress to advance legislation governing commercial surveillance.
Private businesses surveilling people’s web browsing and purchase histories, location and movements, health data, and other information spurred the independent agency to pursue new regulations.
A deadline closed on Monday for the public to comment on how the agency should write new rules that could dramatically alter companies’ operations and people’s online lives, meaning one obstacle is out of the federal government’s way for crafting the rules.
FTC Chairwoman Lina Khan said her team was working to determine whether unfair and deceptive data practices warranted the federal government making new “market-wide rules” instead of addressing problems on a case-by-case basis.
“Firms are collecting data on where we go, what we read, who we meet, what we buy, and research has suggested that many Americans have limited insight into what information is being collected about them and how it’s being used, sold or stored, and that even when people do know, they may find themselves with no real options but to go along with these practices,” Ms. Khan said at a September meeting.
Ms. Khan said that the collection of troves of data has coincided with hacks and leaks and other security vulnerabilities exposing people’s information that can lead to identity theft, discrimination, and other harms.
The FTC is not only worried about how people’s data is collected but how it is analyzed and stored. An FTC fact sheet about the forthcoming rules said the agency is concerned about algorithms scrutinizing people’s behavior and how companies sell such information to advertisers.
The agency published an advanced notice of proposed rulemaking (ANPR) in the Federal Register in August and received nearly 1,000 comments before Monday’s deadline.
Opponents and skeptics of the agency’s plan argue that the FTC’s proposal is unreasonably broad and unjustifiable.
The Interactive Advertising Bureau said the FTC is poised to make sweeping changes without clearly explaining what the government intends to do. The bureau said it represents more than 700 companies, and its website said the list of general members includes prominent companies such as CNN, Fox News, Google, Twitter, TikTok, Taco Bell, Comcast and Best Buy.
“While the ANPR attempts to focus on two key practices, ‘commercial surveillance’ and ‘lax data security,’ these practices are defined so broadly that it is nearly impossible to understand the areas that are under the Commission’s consideration,” the bureau wrote to the FTC earlier this month.
The bureau said the FTC’s definition of commercial surveillance may involve any online activity using consumers’ data, which the bureau said would rope in “nearly every sector of the economy.”
Other critics said that the FTC did not have the proper authority to enact such regulations.
The libertarian-leaning R Street Institute said the FTC’s proposal extended far beyond what Congress has authorized.
“In contrast to acting under Congress’s narrower view for the FTC, the ANPR sets forth 95 questions on a wide range of issues from biometrics to targeted advertising,” the R Street Institute said. “The rules’ themes can even extend beyond this since the ANPR states that it does not identify the full scope of potential approaches the FTC might undertake by a rule.”
Federal lawmakers have tried and failed to advance new privacy legislation. Reps. Frank Pallone, New Jersey Democrat, and Cathy McMorris Rodgers, Washington Republican, introduced in June the American Data Privacy and Protection Act that intends to minimize the collection of people’s data, allow people to turn off targeted ads and create a new privacy bureau within the FTC.
The bill hit a roadblock from Senate Democrats, with Senate Commerce Committee Chairwoman Maria Cantwell of Washington saying there was no chance her fellow Democrats would bring the bill up for a vote.
If Congress decides to reconsider privacy legislation next year, Ms. Khan has made clear the FTC would reevaluate its actions, but she had no intention of stopping without robust new rules.
“If Congress passes strong federal privacy legislation — as I hope it does — or if there is any other significant change in applicable law, then the Commission would be able to reassess the value-add of this effort and whether continuing it is a sound use of resources,” Ms. Khan wrote in an August note in the Federal Register.
