Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Advanced Search Go
Free Newsletter Sign Up

ANALYSIS: How Will the FTC Get Its Privacy Mojo Back in 2022?

Nov. 1, 2021, 7:00 AM

The Federal Trade Commission has faced a multitude of challenges to its enforcement authority, but there are signs that a recharged Commission will seek a consumer privacy comeback in the next year. So it bears asking: What would a restrengthened—and well funded—FTC look like? And what can legal practitioners reasonably expect regarding the FTC’s priorities in the new year?

Beleaguered by major enforcement hits, lack of staffing, and funding issues, the FTC has hit a regulatory rough patch these last few years. By my lights, it is worth examining three possible FTC strategies to bolster the regulator’s consumer privacy power:

  1. Institutional innovation and creativity in rulemaking
  2. Leveraging new leadership with congressional Dems’ political capital
  3. Exploring unprecedented funding initiatives

Practitioners should be on notice about an active FTC that seeks to clarify data security standards and expedite the creation and passage of uniform federal privacy legislation.

Major Enforcement Hits

2021 has been a devastating year for the FTC’s remedial consumer privacy authority. The Supreme Court’s AMG Capital Mgmt. v. FTC ruling delivered a death blow to the Commission’s ability to obtain restitution and equitable redress for defrauded consumers in federal court, a powerful weapon that the Commission has wielded for nearly four decades to recoup billions.

Simply put, the SCOTUS ruling decimated the privacy agency’s longstanding and effective ability to obtain equitable monetary remedies (restitution and disgorgement) under Section 13(b) of the FTC Act. To add insult to injury, the ruling further kneecapped the under-resourced FTC with limited residual options and a dearth of viable civil penalty options. Turning the federal court recoupment faucet off means that the FTC is constrained by an extremely cumbersome and time-consuming administrative process. And while this is great news for consumer businesses, privacy practitioners will lament the loss of the FTC’s primary consumer redress tool.

Furthermore, still reeling from the Trump Administration’s gutting of resources, the FTC remains overstretched, undermanned, and underfunded. But it’s not without options. Here’s a forecast for how the FTC may respond through rulemaking, which could be useful for in-house counsel navigating these uncertain times.

Innovation Through Rulemaking

Legal practitioners are aware that it can take the Commission years to promulgate rules. With that in mind, I think it’s likely that the FTC will turn to strategic and creative rulemaking processes and seek to innovate past their current quagmire. Counsel should certainly be on notice that the FTC will engage under-utilized provisions in the FTC Act, resurrecting “oldies but goodies” from the enforcement playbook. Indeed, the FTC has already begun signaling a willingness to pursue alternative civil penalty actions, such as Section 5(m)(1)(b).

The FTC could utilize Section 5(m)(1)(b) of the Act in order to send “Notice of Penalty Offenses” letters to companies possibly engaging in previously litigated deceptive conduct. The notice contains examples of deceptive conduct or claims and constitutes “actual knowledge” by the company that those practices violate the law. The FTC has noted that “should the company then continue to engage in those acts or practices, the FTC may sue in federal court, seeking civil penalties.” However, such proceedings have an extremely spotty track record for actual use (most recently only used to target for-profit higher education organizations) and have traditionally been plagued by procedural barriers and technical statutory limitations.

While the FTC may still obtain remedial relief under the law’s Section 5(l) or Section 19, companies will be glad to hear that proceedings under these rules are still constrained by the agency’s red tape-ridden administrative process. However, they should still be wary of potential wiggle room for increased FTC utilization of these processes.

The FTC has also indicated enthusiasm toward improving and amending Section 18 rulemaking, as evidenced in its July approval to update and enable easier promulgation of consumer privacy rules. Momentum and encouragement for such FTC rulemaking initiatives were further bolstered by the Biden Adminstration’s executive order on competition, a clear sign that the White House endorses the FTC’s consumer data privacy authority as well as its fresh thinking in data privacy rulemaking.

Counsel for consumer businesses complying under the threat of regulatory intervention needs to be on the lookout for a possible development in which a new FTC rulemaking initiative is engaged in tandem with a congressional push for federal privacy legislation, accompanied by political capital to overcome strong bipartisan resistance.

Leveraging Democratic Political Capital

The odds are likely that the FTC will seek to optimize and strengthen its authority via its new left-leaning leadership. Lawyers should keep an eye on how the FTC leverages and aligns political capital in a way that maximizes innovation and cooperation with Democrats in Congress. Be ready for a robust rulemaking effort by the FTC, accompanied by a strong push for uniform privacy legislation.

The confirmation of Alvaro Bedoya as an FTC commissioner will likely give the FTC new leadership and momentum to focus on alternative rulemaking in consumer privacy protection. Additionally, Lina Khan, the new FTC chairwoman, has expressed interest in forging new antitrust rules, which could extend to creating additional privacy rulemaking.

In terms of political calculus, a strengthened regulator faces the same bipartisan gridlock characterized by a divided Congress. Yet legal practitioners should be aware of a growing momentum on both sides of the aisle, seeking more stringent regulations on unbridled Big Tech firms, as well as emerging nonpartisan sentiments toward seeking protection for children online.

Exploring Unprecedented Funding Initiatives

On Sept. 14, the House Committee on Energy and Commerce voted to appropriate an unprecedented $1 billion over 10 years to the FTC to establish and operate a new privacy bureau. Such an infusion, if passed by Congress, would instantly transform the FTC’s ability to effectively regulate unfair or deceptive acts or practices relating to privacy, data security, and data abuses. To put this infusion into perspective, it is critical to compare to FTC’s privacy budget for 2021 ($13 million) to its overall budget of $351 million.

Looking forward to 2022, it is likely that continued political alignment will be necessary to reinforce (and perhaps even expand) the FTC’s data privacy enforcement power. However, proponents of the FTC funding boost will need to reckon with rigorous bipartisan scrutiny in the Senate, as well as fierce opposition skepticism by Republicans and centrist Democrats alike. At the very least, proposals will face serious funding trimming, and even full-throated opposition, by legislators concerned about agency overreach.


The FTC may or may not find full redemption in 2022. But privacy and data security counsel everywhere need to be enlightened about future FTC strategies seeking stronger privacy enforcement authority.

What is certain is that Big Tech—and all businesses—should prepare for an active, robust, and empowered consumer privacy watchdog that’s keen to police data misuse and privacy violations. From a business standpoint, an empowered FTC could translate into increasing penalties, persistent scrutiny extending beyond data breaches, and recurring monetary fines.

Access additional analyses from our Bloomberg Law 2022 series here, including pieces covering trends in Litigation, Regulatory & Compliance, Transactions & Contracts, and the Future of the Legal Industry.

Bloomberg Law subscribers can find related content on our Privacy and Data Security Practice Center resource.

If you’re reading this on the Bloomberg Terminal, please run BLAW OUT <GO> in order to access the hyperlinked content, or click here to view the web version of this article.