Yesterday, the U.S. Federal Trade Commission took the first formal step in its highly anticipated privacy rulemaking process, issuing an Advance Notice of Proposed Rulemaking titled “Commercial Surveillance and Data Security.” (See the news release, fact sheet, and IAPP’s news analysis.) The ANPR seeks public comments on nearly a hundred substantive questions related to consumer privacy and data security practices.

What does the FTC mean by “commercial surveillance?” The ANPR, helpfully, includes a definition: “the collection, aggregation, analysis, retention, transfer, or monetization of consumer data and the direct derivatives of that information. These data include both information that consumers actively provide … as well as personal identifiers and other information that companies collect, for example, when a consumer casually browses the web or opens an app. This latter category is far broader than the first.”

For further context, the agency also sums up its initial overview paragraphs of the ANPR by referring to the practices described therein as “these commercial surveillance practices.” The preceding paragraphs focus primarily on the abundance of data monetization, accumulation, and personalization practices and the dearth of purpose limitations and meaningful consumer choices.

The potential breadth of scrutiny over all of such “commercial surveillance” is a core critique of Commissioner Noah Phillips’ dissenting statement, in which he claims that it “captures any collection or use of consumer data,” and that, “without specific questions about business practices and potential regulations, the Commission cannot hope for tailored responses providing a full picture of particular practices.” The dissenting statement from Commissioner Christine Wilson and concurring statements from Chair Lina Khan and Commissioners Rebecca Kelly Slaughter and Alvaro Bedoya are also worthy of review.

Nevertheless, some breadth may be justified here, as this is just the first step of the FTC’s Magnuson-Moss rulemaking process, through which the commission will establish a public record to help it identify a “widespread pattern” of practices that meet the definition of unfair or deceptive trade practices under Section 5 of the FTC Act. The IAPP has a helpful infographic explaining the various stages of the complex process, which is congressionally mandated to include multiple steps on top of the Administrative Procedure Act rulemaking process that most U.S. agencies follow. For example, in addition to teeing up the area of inquiry, the initial ANPR asks a “should we” question, pondering whether rulemaking is the right tool for the FTC to use to address its concerns. In fact, the FTC is statutorily required to seek and consider feedback on “any suggestions or alternative methods for achieving” the objectives described in the ANPR 15 U.S.C. § 57a(b)(2)(A).

For what will probably turn out to be a lively discussion about such alternative methods, the scope of commercial surveillance, and other questions raised by the ANPR, please join me for a LinkedIn Live session next Monday featuring Maureen Ohlhausen, former acting Chairman of the FTC, and Jessica Rich, former Director of the Bureau of Consumer Protection.

Here's what else I’m thinking about:

• How to submit your comments to the FTC. When the ANPR is printed in the Federal Register, a 60-day countdown will begin for initial public comments to be submitted. Note that this is the first of multiple comment periods under the Magnuson-Moss process. The FTC also scheduled a public forum where individual commenters will each have two minutes to speak.

• Meanwhile, FTC Commissioner Phillips announced his departure. The commissioner will step down in the fall. The news was greeted with statements of regret from fellow commissioners who praised Phillips’ major contributions to the agency’s work, with Commissioner Bedoya tweeting that he has been “always thoughtful, careful, and unfailingly personally generous.” The FTC cannot have more than three commissioners from the same political party, so Phillips’ eventual replacement will not be a Democrat.
• The Washington Post endorsed the ADPPA. In a statement by its Editorial Board, the paper encouraged House Speaker Nancy Pelosi, D-Calif., to bring the American Data Privacy and Protection Act to a vote, writing, “This legislation is a compromise years in the making. … Congress should take a vote on privacy as soon as possible and break its losing streak.” For new substantive analysis of the bill, check out the article in Tech Policy Press by Alan Butler and Caitriona Fitzgerald of the Electronic Privacy Information Center, which includes a chart comparing the ADPPA with California’s law and concludes: “We believe that the ADPPA is stronger in several key areas then California’s CCPA, that it would provide roughly equivalent protections in most circumstances, and that the few areas where the CCPA is stronger could be addressed through minor amendments to the ADPPA.”
• The CFPB warned digital marketers they may be subject to the Consumer Financial Protection Act. In a new interpretive rule, the Consumer Financial Protection Bureau clarified that marketers engaged in ad targeting and delivery for financial firms do not qualify under the “time or space” exception and must adhere to consumer protection rules.

Under scrutiny

• The normalization of “ceaseless” surveillance in public spaces is the subject of a Gizmodo article titled "The Surveillance Fantasies of the New Millennium Became Our Reality."
• AI’s lack of redress mechanisms is explored in a white paper from the Center for Long-Term Cybersecurity, which offers a number of policy solutions, including establishing complaint processes within organizations.
• Amazon’s announced acquisition of iRobot sparked questions related to what “ambient intelligence” data would mean in combination with Amazon’s other collected personal data.

Upcoming happenings

• Aug. 15 at noon EDT, the IAPP hosts a LinkedIn Live titled "Start your engines: What does FTC rulemaking mean for privacy?"

Please send feedback, updates and thoughts on commercial surveillance to cobun@iapp.org.