FTC Chair Calls for Shift From ‘Overwhelming’ Privacy Policies

The Federal Trade Commission’s leader called for a new approach to consumer data protection to replace the “overwhelming” privacy policies governing companies’ collection and use of consumer data.

FTC Chair Lina Khan suggested a shift away from the “outdated and insufficient” notice and consent framework, where companies ask consumers to agree to lengthy privacy policies that are heavy on legal text.

“Going forward, I believe we should approach data privacy and security protections by considering substantive limits rather than just procedural protections,” she said during a Monday event hosted by the International Association of Privacy Professionals.

Khan, a Democrat who’s pursuing an agenda of aggressive antitrust enforcement, is under mounting pressure from privacy advocates to kick off long-anticipated federal rules protecting the personal information that companies across sectors collect on Americans.

She pushed for “market-wide rules” governing consumer data protection in her first public comments outlining privacy policy priorities. Such rules could give businesses clearer guidance on how to keep people’s data private and secure while giving focus to the agency’s enforcement efforts.

The commission signaled interest in writing data privacy rules by adding the topic to its regulatory agenda for the first time in December. But with two Democrats and two Republicans on the commission, launching a potentially years-long rulemaking process likely depends on Senate confirmation of Alvaro Bedoya, the Georgetown University law professor picked to fill the FTC’s empty fifth seat.

The Senate is expected to vote on Bedoya’s confirmation after its two-week Easter recess, potentially giving Khan the Democratic majority she needs to vote on starting privacy rules.

Privacy Law

Advocates of boosting the FTC’s data protection mission face opposition from Republicans on the commission and in Congress who would rather wait for a federal law that directs the agency’s efforts.

Congress has floated a federal privacy law, but legislative proposals so far have stalled on issues including whether individuals should have a right to sue companies over how their data is handled. Whether a federal law would overtake state law is another open question as states increasingly adopt their own privacy bills.

Khan said a federal privacy law could help usher in a paradigm shift away from notice and consent.

“Even without a federal privacy or security law, the FTC has for decades served as de facto enforcer in this domain,” she said at the event.

Data-related enforcement actions so far in Khan’s tenure as chair have focused in part on alleged violations of children’s privacy law, including settlements with online advertising platform OpenX Technologies Inc. and WW International Inc.'s online weight management program for kids. The FTC also banned from the surveillance business SpyFone, a company behind an app that allegedly spied on people’s phones through a hidden device hack.

Khan touted these settlements as examples of the commission’s efforts to harness its “scarce resources” by focusing on firms whose business practices cause widespread harm.

She also pointed to the agency’s hiring of artificial intelligence researchers and other technologists to join the lawyers, economists, and investigators who lead its enforcement work. “We plan to continue building on this team,” Khan added.