• by Wendy Davis  @wendyndavis, August 11, 2022

The Federal Trade Commission on Thursday officially began the lengthy process of crafting privacy rules that could restrict online data collection.

As a first step in what's likely to be a years-long initiative, the agency is soliciting feedback from the public on a broad range of issues, including “commercial surveillance” -- which it defines as "the collection, aggregation, analysis, retention, transfer, or monetization of consumer data and the direct derivatives of that information."

The FTC specifically seeks input on whether to regulate how companies “collect, aggregate, protect, use, analyze, and retain consumer data,” and how they “transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive.”

“Whether they know it or not, most Americans today surrender their personal information to engage in the most basic aspects of modern life,” the FTC states in the official advance notice of proposed rulemaking.

The agency adds that it is launching the initiative “because recent Commission actions, news reporting, and public research suggest that harmful commercial surveillance and lax data security practices may be prevalent and increasingly unavoidable.”

The notice goes on to suggest that the current approach to online privacy -- which involves notifying consumers about data collection and seeking their consent on an opt-out or opt-in basis -- may be inadequate.

“The permissions that consumers give may not always be meaningful or informed,” the notice states, adding that many people don't have the time to review lengthy privacy policies and their periodic updates.

“Companies can use the information that they collect to direct consumers’ online experiences in ways that are rarely apparent -- and in ways that go well beyond merely providing the products or services for which consumers believe they sign up,” the agency adds.

The FTC poses more than 90 specific questions, including whether new privacy rules should limit data collection and targeted advertising.

The agency also asks how “cost-effective” contextual advertising is, compared to targeted advertising.

In one somewhat surprising series of questions, the FTC appears to ask whether privacy rules should prohibit default settings that block cookies. The exact wording is: “To what extent, if at all, do firms that now, by default, enable consumers to block other firms’ use of cookies and other persistent identifiers impede competition? To what extent do such measures protect consumer privacy, if at all? Should new trade regulation rules forbid the practice by, for example, requiring a form of interoperability or access to consumer data?”

The agency's three Democratic commissioners said they supported the new initiative, while the two Republicans, Christine Wilson and Noah Phillips, dissented.

Phillips called the FTC's notice “vast and amorphous,” adding that the scope of potential rules is “impossible to discern from this sprawling document.”

He added that any attempt to ban targeted advertising “will be a heavy lift for many reasons, not the least of which is that we have never brought a case alleging that targeted advertising is unfair.”

Advocacy groups including Consumer Reports, the Center for Democracy & Technology and Fairplay -- which have long pushed for more stringent privacy standards -- are praising the FTC's decision to move forward with potential regulations.

But the ad industry organization Privacy for America criticized the initiative, calling it “an overly broad and radical proposal.”

Stu Ingis, counsel to Privacy for America, adds that commission appears to have already made up its mind, pointing to the use of the phrase “commercial surveillance.”

“That's a derogatory term to start with,” he says.

He adds that the notice released Thursday contains examples of practices the FTC has criticized, but doesn't include a “commensurate list of benefits” of the use of data.

The FTC plans to hold a virtual public forum on the initiative on September 8.