FTC Privacy Rules Will Be in Limbo Until Trump Transition (1)

Imminent change in leadership at the Federal Trade Commission under a second Trump administration has cast uncertainty on the future of two long-awaited privacy proposals introduced by the outgoing Biden administration.

A sweeping proposal on commercial surveillance and updates to children’s privacy rules will be under the control of Republican commissioners who have accused the FTC of overstepping its bounds during the last four years. The commission’s two Republicans, Melissa Holyoak and Andrew N. Ferguson, have repeatedly opposed the Biden FTC’s alleged overreach, offering a “roadmap” for the agency’s next four years, said Kathleen Benway, former chief of staff at the FTC’s Bureau of Consumer Protection who’s now a partner at Alston & Bird.

“There have been very expansive readings of some of the laws that the FTC enforces,” Benway noted. “That’s been criticized by the Republicans—I think we’ll see some paring back of that.”

Before the FTC is recalibrated, Republicans in Congress have warned the outgoing FTC against pursuing ambitious rulemaking or enforcement, arguing its mandate ended with Donald Trump’s election. On Nov. 7, Sen. Ted Cruz (R-Texas), the ranking member the Senate Commerce, Science, and Transportation Committee, wrote in a letter to FTC Chairwoman Lina Khan, urging the agency to “immediately stop all work on outstanding rules, regulations and guidance” and “focus only on matters at that are uncontroversial and would be approved unanimously by all members.”

“Any controversial FTC action taken up or continued after November 5th will receive particular scrutiny,” Cruz warned.

An FTC spokesperson acknowledged receipt of the letter but declined to comment on the status of the rulemakings.

Commercial Surveillance

In August 2022, the agency released an advanced notice of proposed rulemaking aiming to limit “commercial surveillance” by businesses that trade in consumer data. The extensive 95-question inquiry asked about issues ranging from regulations for automated systems to harms against children.

Both Republican FTC commissioners at the time voted against the notice, urging congressional action instead. Then-commissioner Christine Wilson wrote in her dissent that it could “derail” congressional privacy legislation and was “regulatory overreach.”

The current Republican vanguard remains equally opposed, meaning the pending proposed rule is likely to be significantly slashed or even nixed entirely under a Republican-run FTC.

Both Holyoak and Ferguson, who would be a part of the new Republican majority at the agency, have pushed back against what they describe as efforts to act outside of the bounds of the authority Congress bestowed upon the agency. Holyoak made remarks at an advertising conference in September when she questioned the ‘Commercial Surveillance and Data Security Rulemaking’ title. The FTC’s adoption of “that glib phrasing” conveys an “appearance of prejudgment of these difficult issues that is troubling and threatens to undermine the Commission’s stature,” she said.

Both Holyoak and Ferguson could also be candidates to replace Khan as chair. Neither responded to requests for comment on if they would vote for the commercial surveillance rulemaking.

Despite pushback from Republican commissioners and lawmakers on the FTC’s privacy agenda, a Trump-led FTC may still pursue its own version. The agency could focus on less controversial issues like data security, said Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals’ Washington, D.C., office.

Even if the commercial surveillance rulemaking may be dead in the water, that doesn’t mean the agency will back down from privacy entirely. “Traditionally, we see more bipartisan consensus on enforcement than rulemaking,” said Maneesha Mithal, partner at Wilson Sonsini Goodrich & Rosati and former associate director of the Federal Trade Commission’s Division of Privacy and Identity Protection.

Children’s Privacy

A proposal to boost children’s privacy may face fewer obstacles given strong bipartisan support.

In December 2023, the FTC proposed new limits on collecting data on children younger than 13, an authority offered by Congress to the FTC under the 1998 Children’s Online Privacy Protection Act. The proposal, which built off a comment period launched in 2019 during the Trump administration, had the support of all five commissioners.

Finalizing the rule before the end of Khan’s term will “likely to be a high priority for the FTC,” to avoid having to revisit it under the next administration, Zweifel-Keegan said. “Either way, modernizing kids’ privacy protections remains a bipartisan priority.”

The question is how a final rule will differ from proposals. “The ‘how’ we can do it is where the rub really comes up,” said Carlton Fields PA privacy litigator Patricia Carreiro, noting that some responsibility for children’s privacy could be left to the states.

“The distinction between a Democratic and Republican commission in 2025 is that a Republican commission is more likely to stay in the bounds of the statute,” said Laura Riposo VanDruff, partner at Kelley Drye & Warren LLP and former assistant director for the FTC’s Division of Privacy & Identity Protection.

With time running out for the current Democratic majority at the FTC, the agency will have to choose its priorities carefully in order to accomplish anything. Part of the calculation is what could survive a Republican-led FTC.

The “serious” threat is not Congress, but that any lame-duck actions “would be all unwound by a future FTC,” said VanDruff. The agency’s makeover after inauguration could not only roll back the agency’s rulemaking and enforcement efforts, but also redefine some other mechanisms essential to the FTC’s regulatory process under Khan.

For instance, the FTC pursued studies, separate from its enforcement authority, to seek information about an organization’s practices. The agency would then publish reports summarizing its findings and lay out non-binding do’s and don’ts about a company’s practices. Commissioners have challenged the FTC’s use of the studies, including Holyoak, who in September claimed the agency was abusing the reports mechanism to regulate private conduct, “and, at times, incorporate mischaracterizations of what current law requires.”

A more limited scope for its rulemaking, paired with watered down tools, will ultimately lead to “a narrowing of what the commission identifies as sort of the FTC lane,” Benway said.