• by Wendy Davis , Staff Writer @wendyndavis, March 25, 2011

The Federal Trade Commission seems to have stepped up its privacy enforcement efforts lately, but hasn't yet taken action regarding mobile privacy. But that could potentially change.

The FTC's Maneesha Mithal, director of the division of privacy and identity presentation, told attendees at a Fordham Law event today that, even though the agency lacks jurisdiction over common carriers, it can take enforcement actions against app developers that engage in deceptive practices.

What kinds of privacy practices would the FTC consider deceptive? Mithal said two recent cases offered insight. First, the FTC is concerned when companies don't keep users' data secure -- as happened when Twitter security glitches resulted in hackers gaining access to some users' names, passwords and private messages. The agency recently finalized a settlement with Twitter stemming from that data breach.

Secondly, she says, failing to live up to promises in privacy policies can trigger FTC action. The agency recently settled with ad network Chitika for telling users they could click on a link to opt out of online behavioral targeting, but then setting those opt-outs to expire after only 10 days. (Chitika said in a statement that it had intended to set the opt-out link to last for 10 years.)

Beyond that, while the FTC would like to see mobile app developers take privacy-friendly steps -- like shedding information as soon as it's no longer needed, and notifying cell phone users about data collection -- the agency doesn't appear to have the authority to force the issue.

Arguably, however, mobile devices pose more of a privacy threat than cookie-based targeting, because cell phones are almost always tied to just one specific person. What's more, cell phones carry unique device identifiers, which allow app developers and other companies to recognize the phone even if the owner attempts to opt out of targeting.

Even though the FTC can't presently tell app developers how to protect consumers' privacy, the agency might well be able to do so in the future. Former presidential candidate Sen. John Kerry (D-Mass.) is floating a bill that, if enacted in its current form, would empower the FTC to craft new regulations regarding privacy across a variety of platforms. At present another former candidate, Sen. John McCain (R-Ariz.), is listed as the co-sponsor.