WASHINGTON D.C.—The Federal Trade Commission has announced it is exploring rules to crack down on harmful commercial surveillance and lax data security.
“Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts,” said FTC Chair Lina M. Khan in a statement. “The growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.”
The move could have an important impact on targeted and digital advertising, which would seem to fit into the agency’s definition of “commercial surveillance” as the business of collecting, analyzing, and profiting from information about people.
“Mass surveillance has heightened the risks and stakes of data breaches, deception, manipulation, and other abuses,” the agency said, in announcing the Notice of Proposed Rulemaking.
The FTC’s Advance Notice of Proposed Rulemaking seeks public comment on the harms stemming from commercial surveillance and whether new rules are needed to protect people’s privacy and information.
The Commission voted 3-2 to publish the notice in the Federal Register. Chair Khan, Commissioner Rebecca Kelly Slaughter and Commissioner Alvaro Bedoya issued separate statements. Commissioners Noah Joshua Phillips and Christine S. Wilson voted no and issued dissenting statements.
In announcing the move, the FTC said the business of commercial surveillance can incentivize companies to collect vast troves of consumer information, only a small fraction of which consumers proactively share, the FTC said.
Companies reportedly surveil consumers while they are connected to the internet – every aspect of their online activity, their family and friend networks, browsing and purchase histories, location and physical movements, and a wide range of other personal details, the agency noted.
The agency also said that it is seeking comment on a wide range of concerns about commercial surveillance practices. For example, some companies fail to adequately secure the vast troves of consumer data they collect, putting that information at risk to hackers and data thieves, the FTC said. There is a growing body of evidence that some surveillance-based services may be addictive to children and lead to a wide variety of mental health and social harms, the agency said.
The FTC also said that “very little is known about the automated systems that analyze data companies collect” and that “research suggests that these algorithms are prone to errors, bias, and inaccuracy. As a result, commercial surveillance practices may discriminate against consumers based on legally protected characteristics like race, gender, religion, and age, harming their ability to obtain housing, credit, employment, or other critical needs.”
Other concerns stem from the ways in which companies make commercial surveillance difficult to avoid, the FTC said. Some companies require people to sign up for surveillance as a condition for service. Consumers who do not wish to have their personal information shared with other parties may be denied service– or required to pay a premium to keep their personal information private. After consumers sign up, companies may change their privacy terms going forward to allow for more expansive surveillance. Companies increasingly employ dark patterns or marketing to influence or coerce consumers into sharing personal information.
