Resource Center / Infographics / FTC Privacy Rulemaking – The Steps to Get There
FTC Privacy Rulemaking – The Steps to Get There
This resource outlines the key rulemaking steps of the U.S. Federal Trade Commission.
Published: December 2021
This resource outlines the key privacy rulemaking steps of the U.S. Federal Trade Commission.
Actions and statements by the FTC in 2021 made it clear the commission intends to use its rulemaking authority under Section 18 of the FTC Act, 15 U.S.C. §57a, to formulate rules prohibiting unfair or deceptive acts or practices. A recently published notice states the FTC is considering initiating a rulemaking “to curb lax security practices, limit privacy abuses, and ensure that algorithmic decision-making does not result in unlawful discrimination.”
The rulemaking process under Section 18, referred to as “Magnuson-Moss” or “Mag-Moss” rulemaking, requires more than informal rulemaking under the Administrative Procedures Act. Historically, it is a lengthy process that can take several years to complete. In July 2021, the FTC revised its Rules of Practice.
FTC Privacy Rulemaking: The Steps to Get There
1. Advance Notice of Proposed Rulemaking
The FTC must publish an ANPR in the Federal Register and submit it to certain congressional committees, describing the area of inquiry under consideration, the objectives and possible regulatory alternatives (§57a(b) (2)). The FTC notice gives an ANPR date of February 2022. There is a public comment period following the ANPR, where interested parties are invited to respond to the proposed rulemaking, including suggestions or alternative methods for achieving the objectives (§57a(b)(2)(A)(ii)).
2. Notice to Congress
If the FTC decide to proceed with a proposed rulemaking, certain congressional committees must receive notice 30 days before the notice of proposed rulemaking is published (§57a(b)(2)(C)).
3. Notice of Proposed Rulemaking
The FTC must publish a NPR “stating with particularity the text of the rule, including any alternatives, . . . and the reason for the proposed rule” (§57a(b) (1)(A)). A NPR can only be issued where the FTC has reason to believe the unfair or deceptive acts or practices “are prevalent.” (§57a(b)(3)). When the FTC publishes a NPR, it is required to issue a preliminary regulatory analysis related to the proposed rule (15 U.S.C. §57b-3(b)(1)). There is an opportunity for public comment following the NPR. Interested persons must be allowed “to submit written data, views, and arguments,” and the FTC is required to make these submissions publicly available (§57a(b)(1)(B)).
4. Informal Hearings
Informal hearings are required if requested by interested parties and include the right to conduct cross-examination and to present rebuttal submissions in certain circumstances. If hearings are held, the presiding officer is required to “make a recommended decision.” (§57a(c)).
5. Develop and Publish the Final Rule
The FTC develops a final rule, including a statement of basis and purpose that includes statements regarding the prevalence of the acts or practices addressed by the rule, the manner and context in which the acts are unfair or deceptive, and the economic effect of the rule (§57a(d)(1)). When the FTC promulgates a final rule, it is required to issue a final regulatory analysis (§57b-3(b)(2)). The final rule must be published 30 days before the rule’s effective date (5 U.S.C. §553(d)).
6. Enforcement
The FTC can bring suit in federal court to recover civil penalties against anyone who violates a trade regulation rule “with actual knowledge or knowledge fairly implied” that the act is unfair or deceptive and prohibited by the rule (15 U.S.C. §45(m)(1)(A)). The FTC also may bring a civil action against any person who violates a rule to redress injury to consumers or others (15 U.S.C. §57b(a)(1)). FTC Rulemaking Authority.