• by Wendy Davis  @wendyndavis, December 15, 2021

Signaling a crackdown on data practices, the Federal Trade Commission has taken the first steps toward crafting new privacy regulations.

The agency quietly said in a recent regulatory filing that it was considering "initiating a rulemaking under section 18 of the FTC Act to curb lax security practices, limit privacy abuses, and ensure that algorithmic decision-making does not result in unlawful discrimination.”

The filing said the FTC was at the "prerule" stage, and indicated that the next step in the rulemaking process would occur in February.

The FTC's move indicates that regulators are closely eyeing ad-tech companies and other businesses that draw on consumers' data, according to attorney Daniel Goldberg, who heads the privacy practice at Frankfurt Kurnit Klein & Selz.

“At the federal level, there is going to be more scrutiny with respect to privacy practices,” he predicts.

Unlike some other federal agencies, the FTC rarely issues regulations -- largely because a 1980 law imposes daunting procedural hurdles.

Among other requirements, the 1980 law requires the FTC to determine that unfair or deceptive conduct is prevalent in an industry, and to hold informal hearings at which any interested parties can conduct cross-examinations. (Those procedures don't apply when Congress has specifically tasked the FTC with developing regulations that implement a law.)

The entire process could take years, according to attorney Phyllis Marcus, a partner at the firm Hunton Andrews Kurth and a veteran of the FTC, where she led the agency's enforcement of the Children's Online Privacy Protection Act.

Marcus says that when she was at the FTC, the “absolute repeated mantra” was that rule-making takes too long.

“The new commission, under Chair Lina Khan, is taking a fresh look at that mantra,” Marcus says.

In the past, FTC has set out its expectations regarding privacy through techniques like issuing guidance, or entering into settlement orders. Those moves, however, don't carry the same force as formal rules, which could empower the agency to fine first-time violators.

The FTC hasn't yet said what type of substantive rules it is contemplating. 

Goldberg says one factor potentially driving the FTC's apparent push for regulations is that legislation has stalled in Congress.

The agency's “prerule” notice comes around three months after Commissioner Rebecca Kelly Slaughter said new privacy regulations “would be beneficial to consumers and businesses alike.”

“Although it is much maligned, the FTC does have rulemaking authority under Section 18 of the FTC Act to address prevalent conduct that is unfair or deceptive,” she said in a speech delivered to the National Advertising Division, a unit of the BBB National Programs. “It is incumbent upon us to use the tools Congress explicitly gave us -- which include rule-writing authority -- to carry out our statutory mission.”

She said in the same speech that the agency could potentially companies to limit the amount of data they collect about consumers.

“A minimization framework would not outright ban surveillance advertising, but it would effectively disable it,” she stated.

“If companies cannot indiscriminately collect data, advertising networks could not build microtargeting profiles,” Slaughter added. “Without the monetization aspect of microtargeting, the incentive to indiscriminately collect data falls away.”

She qualified her remarks by noting there is “no certainty that a rulemaking record would support a minimization rule or any other particular approach.”