FTC Rules TO Crack Down Commercial Surveillance

Companies increasingly employ dark patterns or marketing to influence or coerce consumers into sharing personal information. FTC seeks to protect consumers by  incentivizing all companies to invest more consistently in compliant practices.

The US Federal Trade Commission recently announced exploring rules to crack down on harmful commercial surveillance and lax data security. These rules can potentially jeopardize survival tactics put together by global brands to thrive in the cookie-less era but can be a relief to internet users. 

The release issued by FTC stated that commercial surveillance is the business of collecting, analyzing, and profiting from information about people and further mentioned that mass surveillance has heightened the risks and stakes of data breaches, deception, manipulation, and other abuses. People can submit their suggestions 60 days from the publication of this notice. 

The FTC’s Advance Notice of Proposed Rulemaking seeks public comment on the harms of commercial surveillance and whether new rules are needed to protect people’s privacy and information.

“Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts,” said FTC Chair Lina M. Khan.

 “The growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent,” said Khan. “Our goal today is to build a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should look like,” she added. 

Commercial Surveillance

FTC shared that the business of commercial surveillance can incentivize companies to collect vast troves of consumer information, only a tiny fraction of which consumers proactively share. Companies reportedly watch Internet users – every aspect of their online activity, their family and friend networks, browsing and purchase histories, location and physical movements, and a wide range of other personal details.

Companies use algorithms and automated systems to analyze the information they collect. And they make money by selling information through the massive, opaque market for consumer data, using it to place behavioral ads, or leveraging it to sell more products.  

The Rule-Making Process

The FTC is seeking comment on various concerns about commercial surveillance practices. For example, some companies fail to adequately secure the vast troves of consumer data they collect, putting that information at risk to hackers and data thieves. Evidence shows that some surveillance-based services may be addictive to children and lead to various mental health and social harms.

Hiccups in Automated Personal Data Analysis

The automated systems analyze data companies collect, and research suggests that these algorithms are prone to errors, bias, and inaccuracy. As a result, commercial surveillance practices may discriminate against consumers based on legally protected characteristics like race, gender, religion, and age, harming their ability to obtain housing, credit, employment, or other critical needs.

Other concerns stem from how companies make commercial surveillance challenging to avoid. Some companies require people to sign up for surveillance as a condition for service. Consumers who do not wish to share their personal information with other parties may be denied service or required to pay a premium to keep their personal information private. After consumers sign up, companies may change their privacy to allow for more expansive surveillance. Companies increasingly employ dark patterns or marketing to influence or coerce consumers into sharing personal information. 

In the last two decades, the FTC has used its existing authority under the FTC Act to bring hundreds of enforcement actions against companies for privacy and data security violations. These include sharing health-related data with third parties, collecting and sharing sensitive television viewing data for targeted advertising, and failing to implement reasonable security measures to protect sensitive personal data such as Social Security numbers.

Pros and cos

The FTC lacks the authority to seek financial penalties for initial violations of the FTC Act. There is a need for rules establishing precise privacy and data security requirements, which will give the Commission the authority to seek financial penalties for first-time violations. It could incentivize all companies to invest more consistently in compliant practices.