On August 11, 2022, the Federal Trade Commission (FTC) took the first step toward creating national privacy and security rules that, if finalized, would apply across most sectors of the U.S. economy. The agency unveiled an Advance Notice of Proposed Rulemaking (ANPRM), which asks for public comment on 95 questions, ranging from topics such as targeted advertising, security of personal information, algorithmic discrimination, and protection of children and teens. Comments are due within 60 days of publication of the ANPRM in the Federal Register. The ANPRM was issued with a 3-2 vote along party lines. This alert attempts to answer some key questions about the announcement.
What Is the FTC's Authority to Initiate This Rulemaking and Issue a Final Rule?
Section 18 of the FTC Act authorizes the FTC to issue trade regulation rules that define with specificity acts or practices that are unfair or deceptive (known as "Mag Moss Rulemaking"). Under Section 18, the agency must show that the unfair or deceptive acts or practices in question are prevalent, a determination that can only be made if the FTC has previously "issued cease and desist orders regarding such acts or practices," or if it has any other information that "indicates a widespread pattern of unfair or deceptive acts or practices."
What Areas Is the FTC Focused on?
In terms of subject areas that the questions touch on, there are few surprises. The FTC already announced in December 2021 that it would focus on issues like targeted advertising, data security, and algorithms. Given FTC Chair Lina Khan's prior public statements, it is not surprising that the ANPRM includes questions about employee privacy and workplace surveillance, competition, and the shortcomings of notice and consent. Commissioner Rebecca Kelly Slaughter and Commissioner Alvaro Bedoya have both spoken about civil rights and discrimination issues, as well as their concern about children and teens, both of which feature prominently in the ANPRM. A couple of points to note:
What Happens Next?
As noted above, the public has 60 days from the date the ANPRM is published in the Federal Register to comment. The FTC will host a virtual forum on September 8, where members of the public will be allowed to speak for two minutes. (See the process for applying to speak below.) After the 60-day comment period is over, the FTC will issue a Notice of Proposed Rulemaking, which will likely contain the rule text. After the comment period, a final Rule would still be some distance away. The average Mag Moss rule typically takes about five-to-six years; the Mag Moss rulemaking process allows any interested person to seek a hearing and present views. Indeed, the five-to-six-year timeline is likely to underestimate the time it would take to pass the type of broad-based Rule envisioned by the ANPRM; past Mag Moss Rules have primarily focused on narrower sectors of the economy (e.g., eyeglasses, funeral homes, home insulation).
Will the FTC Face Legal Challenges?
Even setting aside timing concerns, observers are discussing the implications of the U.S. Supreme Court's decision in West Virginia v. EPA on the FTC's rulemaking proceeding. In that case, the Supreme Court struck down an U.S. Environmental Protection Agency (EPA) rule, noting that the Rule went beyond the Congressional grant of authority. In a statement issued along with the ANPRM, Commissioner Slaughter attempts to distinguish the EPA case, noting that, with respect to the FTC's rulemaking proceeding, "Congress explicitly empowered the FTC to define with specificity acts or practices which are unfair or deceptive acts or practices in or affecting commerce." Unlike in West Virginia v. EPA, she notes that the FTC's delegated authority is not defined by "modest words," "vague terms," "subtle devices," or "oblique or elliptical language."
Why Should I Pay Attention?
The FTC appears to be considering approaches that could have a profound impact on the existing regulatory landscape and business models in place today. For example, the ANPRM asks about the extent to which new rules should "limit" targeted advertising. As another example, the current FTC approach to protecting children's privacy focuses on primarily regulating services directed to children under the age of 13. The ANPRM asks whether there should be enhanced protections for services that simply have large numbers of child users, potentially affecting social media, gaming, and sports and entertainment content that may be attractive to children. And the ANPRM asks whether techniques that "manipulate" consumers into prolonging online activity (e.g., video autoplay, infinite or endless scroll) may be unfair. A Rule provision on this issue could affect numerous consumer-facing companies.
As discussed above, while some might say that a final rule is a long way in the future and may in fact never happen, any proposed Rule issued by the FTC will be influential. As the ANPRM itself states, "[T]hese comments will help to sharpen the Commission's enforcement work and may inform reform by Congress or other policymakers, even if the Commission does not ultimately promulgate new trade regulation rules." Given the impact even a proposed rule is likely to have, companies should weigh in with comments. At the very least, they should pay attention to the process, which can provide clues about the FTC's enforcement priorities.
Why Did the Republicans Dissent?
In addition to noting concerns under West Virginia v. EPA, both Commissioner Christine Wilson and Commissioner Noah Phillips express concerns that by undertaking the Rulemaking process, Congress will be less incentivized to act on legislation. The Republican commissioners also express concern about the rhetoric of the ANPRM, with Commissioner Wilson noting that "[m]any practices discussed in this ANPRM are presented as clearly deceptive or unfair despite the fact that they stretch far beyond practices with which we are familiar, given our extensive law enforcement experience." Commissioner Phillips further takes issue with the fact that, in his view, the ANPRM is too broad to elicit meaningful feedback. And finally, Commissioner Phillips describes a number of substantive concerns. He takes issue with what he views as a step toward banning targeted ads, doing away with the concept of consumer consent, and regulating employee privacy, among other things.
In response, the Democratic commissioners dismiss concerns about disincentivizing Congressional action, with Commissioner Slaughter noting, "I am certain that action by the FTC will not clip the wings of Congressional ambition" and Commissioner Bedoya stating that he would not to vote for a final rule if Congress acts to cover the same practices in the interim. In response to concerns about the breadth of the proceeding, Commissioner Bedoya views such breadth as "a feature, not a bug," citing the need for a "diverse range of public comments to help us discern whether and how to proceed with Notices of Proposed Rulemaking."
What Should Companies Potentially Affected by the ANPRM Do?
Wilson Sonsini Goodrich & Rosati closely follows developments with regulatory organizations such as the FTC. For more information, or if you need assistance with regulatory compliance regarding children's privacy, targeted advertising, or other privacy or consumer protection issues, please contact Lydia Parnes, Chris Olsen, Tracy Shapiro, Maneesha Mithal, Libby Weingarten, or another member of Wilson Sonsini's privacy and cybersecurity practice.