The U.S. Federal Trade Commission's privacy enforcement activity has risen significantly over the last year. And the latest wide-ranging report on commercial surveillance and lax data security practices suggests the agency is preparing to dig in further on its regulatory agenda.
On 19 Sept., the FTC published its report, A Look Behind the Screens, outlining social media and streaming platforms’ data collection practices in 2020. The report is based on Section 6(b) orders under the of the FTC Act issued in 2020 that called on Amazon, ByteDance, Discord, Facebook, Reddit, Snap, WhatsApp, YouTube, and the social platform X to provide information on data retention and collection standards.
The report aimed to add to the “ongoing conversation” around consumer privacy harms in the data economy, according to FTC Associate Director for the Division of Privacy and Identity Protection Ben Wiseman during a LinkedIn Live with IAPP Vice President and Chief Knowledge Officer Caitlin Fennessy, CIPP/US.
Key takeaways
The report generated four key findings from the agency's deep dive, including nonconsensual or uninformed data collection, heavy reliance on targeted advertising based on personal data, the application of algorithms to personal information, and insufficient youth privacy and security measures.
While the FTC indicated each finding did not apply to all observed companies, the agency said the collective findings show the "vast surveillance" being conducted "has come with serious costs to our privacy." The agency also alleged the practices disrupted competition to the point where observed companies "may enjoy significant market power and therefore face fewer competitive constraints on their privacy practices."
Several of the companies allegedly collected large amounts of data from their users, but also nonusers of their services. Wiseman said Information collected included "activities both on and off the platform, things like personal information, demographic information, interests, behaviors, as well as activities elsewhere on the internet."
According to organizations' responses to the FTC's inquiry, a vast amount of observed companies had vague or undefined deletion practices that could fail to protect users' privacy from potential security risks. And although consumers opted in to targeted advertising and typically engaged with a platform's algorithms, users may not have known how much of their data was being collected.
"Some of the companies in fact had purchased information about users from data brokers and other third parties," Wiseman said.
The report found a lack of transparency surrounding companies' use of collection systems. According to Wiseman, a majority of the platforms "were relying on algorithms and feeding extensive amounts of information that they collected about their users into those automated systems."
While companies mostly remained compliant with the Children's Online Privacy Protection Act, the companies did not apply COPPA standards to teenagers' data. The report claimed platforms treated data belonging to users over age 13 as if they were legal adults.
The platforms' claimed defense was children do not use the platforms because of age restrictions. Wiseman indicated the FTC considers those claims "not credible given that its well known that children are using many of these platforms."
FTC recommendations
Wiseman noted that while the FTC only recently released the report, the findings detailed a "snapshot" of the companies' practices from 2020 and may not reflect the companies' current policies. However, the FTC issued recommendations for companies to improve upon the types of lax and insufficient standards cited in its report.
Chief among the recommendations is the reiteration that the U.S. needs comprehensive federal privacy legislation to establish the rules and guardrails to address the issues mentioned in the report. While 19 states have passed comprehensive privacy legislation, Wiseman said a federal law must contain "baseline protections for all consumers."
Extended COPPA requirements to teenagers was another suggestion, with the aim to ensure standard protections and protections for teens' sensitive personal data. The FTC also recommended companies identify problems within their practices that Wiseman characterized as "in tension with protecting consumers privacy."
“A big takeaway from the report is that companies are in a position to better protect consumers' privacy," said Wiseman. "The recommendations go directly to ... what companies can and should do to better protect consumers privacy."
Lexie White is a staff writer for the IAPP.
