JP Harris and Jennifer Lyon | January 29, 2021
On Dec. 14, 2020, the Federal Trade Commission (FTC) issued orders using powers under Section 6(b) of the FTC Act to nine social media and video streaming services that signal future regulatory actions in the field of data privacy. They also warrant some retrospection for businesses of all shapes and sizes.
With a 4–1 vote, the FTC issued orders to Amazon.com, Inc., ByteDance Ltd. (operator of TikTok), Discord Inc., Facebook Inc., Reddit Inc., Snap Inc., Twitter Inc., WhatsApp Inc. and YouTube LLC. In the orders, the FTC makes over 50 requests for information about how the companies collect, use, track, estimate or derive personal and demographic information; how they determine which ads and other content are shown to consumers; whether they apply algorithms or data analytics to personal information; how they measure, promote and research user engagement; and how their practices affect children and teens.
The orders came at least two years after the agency signaled it was planning to use its power to provide more transparency for consumers on how social media companies collect data.
Three commissioners, in a joint statement issued after the vote, indicated the business models of social media companies have “shifted from supporting users’ activities to monetizing them.” They further indicated that “policymakers and the public are in the dark about what social media and video streaming services do to capture and sell users’ data and attention,” and expressed alarm that “we still know so little about companies that know so much about us.”
The FTC hopes to shed light on the reasons companies monitor users’ activities and interactions, and how companies use that information.
In a dissenting statement signed by the sole commissioner against the orders, the commissioner said he agreed with the purpose of the orders but expressed concern that the orders were too broad to provide helpful information for policymakers or the public.
The companies have 45 days to respond, at which point the FTC will evaluate the information.
What the orders signal
The FTC orders raise the likelihood that further regulation of privacy practices will follow. Congress intended the FTC to use its Section 6 authority to serve the public interest: to inform the Commission; to make recommendations to Congress about legislation; and to publish reports about business practices for the public. New or revised legislation is a logical byproduct of the requests for information.
There is bipartisan support for more transparency on how data is collected and processed. For example, in May 2020, U.S. Sen. Ed Markey, D-Mass., joined by a bipartisan group of senators, urged the FTC to use its authority to launch an investigation into children’s data practices in the digital advertising and educational technology sectors. He also expressed support for the new orders as a necessary step in the FTC’s current review of child privacy regulations.
As another example, in September 2020, U.S. Sen. Roger Wicker, R-Miss., proposed the “Safe Data Act,” which would provide consumers with more control over their data and require businesses to safeguard data and be transparent about their data practices.
He noted that because more people are working and shopping from home due to Covid-19, the legislation was even more important.
With bipartisan support, the FTC orders will likely inform Congress as it seeks to further regulate data practices as well as guide future FTC regulations and orders.
Steps businesses can take
While the FTC investigation is ongoing, there are steps companies can take right now to protect their business and prepare for eventual increased regulation, either state or federal.
As companies increasingly rely on e-commerce, they should ensure they are compliant with current laws, proactively prepare for possible future regulation, and be mindful of privacy when collecting data.
Companies should make sure they are compliant with current regulations in whatever states or countries in which they do business — online or in person.
Regardless of future federal action, states are already stepping into the arena to regulate privacy. For example, California enacted the California Consumer Privacy Act (CCPA) in 2018, modeled after Europe’s General Data Protection Regulation, which requires businesses to inform consumers of how their data is used and secured. Many states, including New Hampshire and Massachusetts, have considered legislation modeled after the CCPA, and this trend will likely continue. The new legislative session in New Hampshire has just begun, and already a bill has been proposed to limit the sharing of location data. Companies can prepare for these changes proactively by bringing their privacy practices up to current best practices.
Companies should regularly conduct compliance and risk assessments to ensure they are compliant with the latest regulations and standards. Compliance assessments evaluate a company’s data policies as well as its procedures for consumer consent and requests.
Data security risk assessments ensure the data is stored securely to protect against interruptions. These assessments are the foundation for compliance.
Further, companies should also be mindful of privacy when collecting and processing consumer data. Companies need to keep a careful record of what information they are collecting and how it is stored. If a company’s business model relies on content moderation, data-driven or behavior-based advertising, or third-party advertising such as Facebook advertising, they should closely monitor their business practices to ensure customer privacy. Data mapping is a helpful tool to keep track of a company’s data.
While it is unclear how the FTC will use the information from these orders, it could impose or recommend regulations based on its findings. Companies that rely on data analytics could lose some of the competitive advantage those tools provide if they have not taken proactive measures to prepare for potential regulation.
The marketplace may also drive companies toward greater compliance as consumers get used to flexing the rights afforded to them. Companies of all shapes and sizes should examine their use of data and prepare for future regulations that might affect their business model.
This article was originally published in the New Hampshire Business Review and can be found here.