FTC Considers Adopting Commercial Surveillance and Data Security Rules

Legal Sidebari

FTC Considers Adopting Commercial

Surveillance and Data Security Rules

October 12, 2022

On August 11, 2022, the Federal Trade Commission (FTC) issued an Advanced Notice of Proposed

Rulemaking (ANPRM) announcing that the agency is considering enacting new regulations on

“commercial surveillance” and data security. The ANPRM is significant because it initiates a process that

may result in rules comprehensively regulating companies’ data privacy and data security practices.

While the FTC has long been active in protecting consumers’ data against misuse, its role has primarily

been limited to case-by-case enforcement of the Federal Trade Commission Act’s (FTC Act’s) broad

prohibition on “unfair or deceptive acts or practices.” Adopting generally applicable regulations that

articulate particular data privacy and data security requirements or prohibitions would be a notable change

from this case-by-case approach. The ANPRM is also noteworthy because it would be the first time in

decades that the FTC has adopted a wholly new “Trade Regulation Rule” (TRR) (i.e., a rule adopted

under Section 18 of the FTC Act).

This Sidebar begins by providing a brief background on the FTC’s current role as a data privacy and data

security enforcer. The Sidebar then explains the FTC’s authority under the FTC Act to enact TRRs and

the procedures that it must follow. The Sidebar then summarizes the commercial surveillance ANPRM,

and closes by discussing some considerations for Congress.

The FTC’s Role as a Privacy Enforcer

As discussed in this CRS report, there is no single comprehensive federal law governing how companies

gather and use consumer data. Rather, there is a collection of targeted privacy statutes that are generally

directed at particular types of entities (e.g., healthcare entities, financial institutions, and communications

common carriers) or specific types of data (e.g., children’s data). While the FTC enforces some of these

statutes, the core of its data privacy and data security enforcement authority comes from Section 5 of the

FTC Act. Section 5 prohibits “unfair or deceptive acts or practices” (UDAPs) “in or affecting commerce.”

The FTC is empowered to enforce this prohibition against all persons, partnerships, or corporations, other

than a handful of exempt entities like common carriers and banks.

Section 5’s UDAP prohibition is different from typical privacy statutes in that it does not specify certain

requirements or prohibitions with which all covered entities must comply. For instance, the FTC Act does

Congressional Research Service

https://crsreports.congress.gov

LSB10839

CRS Legal Sidebar

Prepared for Members and

Committees of Congress

Congressional Research Service

2

not impose a bright-line requirement that entities obtain consumers’ consent before collecting their data or

allow consumers to request, correct, or delete their data. Rather, the UDAP prohibition is a broad standard

that the FTC applies to specific factual circumstances. In any UDAP enforcement action, the FTC

typically seeks to demonstrate that the defendant’s actions, in light of the totality of the circumstances,

were either (1) deceptive because they were likely to mislead reasonable consumers about a material fact,

or (2) unfair because they unjustifiably and substantially harmed consumers in a way that the consumers

could not reasonably avoid.

The FTC has used this broad standard to become, as some commentators have said, the “go-to agency for

privacy.” The FTC has brought hundreds of enforcement actions alleging that companies’ data privacy or

data security practices are deceptive or unfair. For instance, the FTC has maintained that companies act

deceptively when they handle personal information in a way that contradicts their posted privacy policies

or other statements, or when they fail to adequately protect personal information from unauthorized

access despite promises that they would do so. The FTC has also alleged that companies’ data practices

are unfair when, for example, they have default privacy settings that are burdensome to change,

retroactively apply a revised privacy policy, or fail to adopt reasonable safeguards to protect personal

information. Most of the FTC’s data privacy and data security enforcement actions are settled rather than

fully litigated, which has resulted in relatively sparse case law on the UDAP prohibition’s application.

Courts have, however, generally recognized the UDAP provision’s flexible nature; at least one court has

agreed with the FTC’s position that a company’s failure to safeguard user data may, in some

circumstances, be “unfair” under Section 5.

In Section 5 UDAP enforcement actions, the FTC may obtain a cease-and-desist order through an

administrative process or an injunction in federal court. As discussed in another Sidebar, however, it is

largely precluded from obtaining monetary relief from first-time violators. The FTC generally may only

obtain monetary penalties in Section 5 UDAP actions when a company violates a cease-and-desist order

or a consent order. Furthermore, it may only obtain equitable monetary relief, such as restitution or

disgorgement, when it firsts obtains an administrative cease-and-desist order and then brings a follow-on

action in federal court, where it must show that a reasonable person would have known that the

defendant’s conduct was dishonest or fraudulent.

The FTC’s Trade Regulation Rules

Section 18 of the FTC Act allows the FTC to issue TRRs defining specific acts or practices as unfair or

deceptive. In contrast to Section 5 UDAP violations, entities that violate TRRs are subject to civil

penalties and a broad range of monetary and other equitable relief. The FTC’s process for enacting TRRs

under Section 18 of the Act is often referred to as Magnuson-Moss rulemaking, as these procedures were

largely added in 1975 by the Magnuson-Moss Warranty-Federal Trade Commission Improvements Act.

Magnuson-Moss rulemaking requires the FTC to comply with several procedures that go beyond the

typical notice-and-comment rulemaking procedures under Section 553 of the Administrative Procedure

Act, which are the default rulemaking procedures for federal agencies. Under typical notice-and-comment

rulemaking, an agency issues a notice of proposed rulemaking (NPRM) and gives interested persons an

opportunity to comment on it before issuing a final rule. In Magnuson-Moss rulemaking, the FTC must

first issue an ANPRM that contains a brief description of the issue and invites interested persons to submit

responses. Following the ANPRM, the FTC may only proceed with the rulemaking if it determines that it

has either issued cease-and-desist orders regarding such acts or practices or has any other information

indicating a “widespread pattern” of unfair or deceptive acts or practices.

If the FTC decides to proceed with the rulemaking, it must issue an NPRM and give interested persons an

opportunity to comment, as well as provide for an informal hearing to resolve any disputed issues of

material fact. These informal hearings are overseen by a Chief Presiding Officer and include oral

Congressional Research Service

3

testimony and, to the extent necessary, opportunities for cross-examination and rebuttals. Following the

informal hearing, the Chief Presiding Officer must recommend a decision to the Commission based on the

Officer’s findings and conclusions of all the material evidence. The FTC’s final rule must be

accompanied by a statement of basis and purpose, which describes the prevalence of the acts or practices

covered by the rule, the manner and context in which the acts or practices are unfair or deceptive, and the

economic effect of the rule. There are also several requirements throughout the process that foster

increased congressional oversight, such as a requirement that the FTC submit the NPRM to its

congressional oversight committees 30 days before publication.

The FTC has infrequently used Magnuson-Moss rulemaking. Most of the FTC’s existing TRRs—such as

its Unavailability Rule, Prenotification Negative Option Plan Rule, and Franchise Rule—were initiated or

finalized before Magnuson-Moss rulemaking procedures took effect. Since 1980, the FTC has used

Magnuson-Moss rulemaking to update existing rules rather than to initiate new rulemakings. The FTC has

shown a renewed interest in Magnuson-Moss rulemaking, however. In July 2021, the FTC changed its

rules of practice to streamline some of the Magnuson-Moss rulemaking requirements, eliminating what it

referred to as “self-imposed red tape” that imposed hurdles beyond what Section 18 requires. For

instance, the revised rules allow the FTC Chair to designate or serve as the Chief Presiding Officer in

informal hearings and allow the Commission to designate disputed issues of material fact for these

hearings earlier on in the process.

The Commercial Surveillance ANPRM

On August 22, 2022, the FTC published an ANPRM that asked for public comment on whether it should

adopt new TRRs on companies’ commercial surveillance and data security practices. The ANPRM

observed that there is an “elaborate and lucrative market” for consumer information. Companies collect,

aggregate, analyze, and disclose consumer data so they can target services and advertisements toward

consumers and better understand consumer behavior. The ANPRM explained that, while these

“personalization practices” have the potential to benefit consumers, they reportedly also facilitate

consumer harms. The ANPRM specifically noted that commercial surveillance practices may, among

other things, make it more likely that “cyberattack[s]” will result in identity theft or fraud, allow bad

actors to target fraudulent products to vulnerable consumers, and lead to a greater reliance on algorithms

that discriminate against consumers based on protected characteristics (such as race, sex, and age) for

things like housing, employment, and healthcare.

The ANPRM also discussed the limitations of the FTC’s case-by-case enforcement of companies’ data

privacy and security practices. The ANPRM emphasized the limited remedies the FTC may obtain for

first-time Section 5 UDAP violations and how the FTC’s limited resources make it difficult to address the

multitude of commercial surveillance and data security practices through case-by-case enforcement.

To build a record for a potential rulemaking, the FTC requested comment on a wide variety of issues

related to commercial surveillance and data security. While it did not “delineate a boundary” on the issues

that commentators may address, it specifically asked for comments on topics such as:









the scope of personal data that should be subject to a rule;

the extent to which commercial surveillance practices or lax security measures harm

children and minors;

whether rules should address companies’ data security practices and whether they should

be informed by data security requirements in existing laws, such as the Gramm-LeachBliley Act and the Children’s Online Privacy Protection Act;

whether rules should address the use of facial recognition or biometric technology;

Congressional Research Service













4

whether rules should impose data-minimization requirements or limit data’s use based on

the purpose for which the consumers provided the data;

whether rules should require companies to take steps to prevent algorithmic errors;

the prevalence of algorithmic discrimination and the Commission’s authority to address

it;

the effectiveness of consumer consent;

the extent to which a rule should require companies to disclose their commercial

surveillance practices; and

how the FTC should account for changes in business practices that may render a

rulemaking obsolete.

The ANPRM explained that, even if the Commission does not ultimately promulgate regulations,

comments on these issues would sharpen its enforcement work and may inform Congress and other

policymakers. The ANPRM also announced a public forum, which was held on September 8, 2022, in

which panelists and members of the public made remarks on the topics addressed in the ANPRM.

The ANPRM was approved by the Commission by a 3-2 vote. Chairwoman Lina Khan, Commissioner

Rebecca Kelly Slaughter, and Commissioner Alvaro Bedoya voted in favor of the ANPRM.

Commissioners Noah Phillips and Christine Wilson dissented. The dissenting commissioners reasoned

that Congress, rather than the FTC, is the proper body to adopt nationwide consumer data and privacy

rules. The dissenting commissioners also criticized the breadth of the ANPRM and its inclusion of topics

that have not traditionally been the subject of its UDAP enforcement actions. For instance, Commissioner

Phillips expressed concern that the Commission appears to be considering banning targeted advertising,

facial recognition technology, and automated decisionmaking technology, although the FTC has never

found these practices to be unfair.

Considerations for Congress

Whether the FTC follows through with its commercial surveillance and data security rulemaking may in

large part depend on whether Congress enacts comprehensive privacy legislation. As discussed in this

Sidebar, on July 20, 2022, the House Energy and Commerce Committee voted to advance the American

Data Privacy and Protection Act (ADPPA) to the full House of Representatives. Should the ADPPA be

enacted, it would direct the FTC to oversee a comprehensive privacy framework. In the ANPRM, both the

majority commissioners and the dissenting commissioners expressed enthusiasm for the ADPPA,

although they drew different conclusions about its implications for the FTC’s rulemaking process.

Commissioner Slaughter maintained that the Commission should not sit “idly by” while Congress

deliberates, and that any record developed through the Commission’s rulemaking would benefit

Congress’s efforts. Commissioner Wilson expressed concern that the ANPRM would be used as an

“excuse to derail the ADPPA.”

Should the FTC complete the rulemaking process and adopt commercial surveillance and data security

TRRs, the regulations may be subject to legal challenge. While the issues raised by any litigation would

depend on the substance of the final rules, one key issue might be whether, in light of the “major

questions doctrine,” the regulations exceed the FTC’s statutory authority. Under the major questions

doctrine, the U.S. Supreme Court has rejected agency claims of regulatory authority when (1) the

underlying claim of authority concerns an issue of “vast ‘economic and political significance,’” and

(2) Congress has not clearly empowered the agency to address that issue. As discussed in this Sidebar, the

Supreme Court recently applied this doctrine in West Virginia v. EPA, holding that the Environmental

Protection Agency (EPA) exceeded its authority under Section 111(d) of the Clean Air Act by

promulgating emission guidelines for power plants that were based in part on shifting electricity energy

Congressional Research Service

5

generation from higher-emitting sources to lower-emitting ones. The Court reasoned, among other things,

that Section 111(d) was a “previously little-used backwater” and that it was unlikely that through this

provision Congress tasked the EPA with “balancing the many vital considerations of national policy

implicated in deciding how Americans will get their energy.”

Given the significant economic impact of data privacy and data security requirements, and the FTC’s rare

use of Magnuson-Moss rulemaking to enact new TRRs, it is possible that a reviewing court would apply

the major questions doctrine to invalidate any broad-ranging commercial surveillance and data security

TRRs. A reviewing court might conclude that comprehensive data privacy and data security regulation is

a “major question” that the FTC Act does not clearly authorize the agency to address. On the other hand,

if final rules primarily address the type of conduct that has been subject to past UDAP enforcement

actions, a reviewing court may be less likely to determine that they exceed the scope of the FTC’s

authority. Even if the TRRs go beyond prior enforcement actions, it might be argued that the intentionally

flexible nature of the FTC Act makes the major questions doctrine a poor fit. Courts have observed that

Congress deliberately drafted the UDAP standard in broad terms because it was “impossible to frame

definitions” that encompass all possible prohibited practices. Thus, the FTC Act’s silence on whether the

FTC may adopt comprehensive data privacy and security rules may be less problematic than in other

major questions cases.

To the extent Congress wants to clarify the FTC’s authority for commercial surveillance and data security

TRRs, it might enact legislation indicating whether it intends for the FTC to have authority to address

these issues.

Author Information

Chris D. Linebaugh

Legislative Attorney

Disclaimer

This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff

to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of

Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of

information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.

CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United

States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,

as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the

permission of the copyright holder if you wish to copy or otherwise use copyrighted material.

LSB10839 · VERSION 1 · NEW