US regulators take first step towards new data privacy rules

The Federal Trade Commission has issued a new notice calling for input on how tech companies handle consumer data, a critical first step in setting binding rules for the industry. Formally known as an Advance Notice of Proposed Rulemaking (ANPR), the filing calls for public comment on data collection, algorithmic discrimination and commercial oversight.

The announcement stops suggesting specific rules, which are unlikely to come this year. Still, the questions suggest that the commission focuses on concrete harm caused by data collection, be it data breaches, ad targeting or algorithmic discrimination. Particular attention is paid to how large companies use automated decision-making systems that can affect consumers without their knowledge.

Fully posted on the FTC site, questions asked in the notice include “what practices do companies use to monitor consumers?” and “how common is algorithmic discrimination based on protected categories such as race, gender, and age?” Others question whether the First Amendment or Section 230 might limit the FTC’s authority to regulate such issues.

The FTC also has a public hearing scheduled on the proposed rules on September 8 encouraging members of the public to testify on the matter.

“Companies are now collecting personal data about individuals on a large scale and in a stunning array of contexts,” FTC Chairman Lina Khan said in a statement accompanying the release. “Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules might look like.”

The regulatory process usually gives the companies involved the opportunity to influence the pending rules, although their role in the process is necessarily limited. Google, Facebook and Apple did not immediately respond to a request about how they would respond to the ANPR.

A number of groups have called on the FTC to take action on data privacy, including lawmakers in Congress. In 2021, a group of Senate Democrats wrote a formal letter to Khan requesting new privacy rules from the commission. “Tech companies have routinely broken their promises to consumers,” the senators wrote, “only to get pulses after a long delay.”

The notification comes just three months after the formal confirmation from FTC Commissioner Alvaro Bedoya, who conducted significant research into data privacy and algorithmic bias prior to joining the commission. The decision to issue the ANPR came after a 3-2 vote, with both Republican commissioners in opposition.

Despite continued push for a federal data privacy standard, Congress has largely stuck with concrete legislation and made a series of proposals that have not received majority support. Most recently, the U.S. Data Privacy and Protection Act passed the House committee, but is still awaiting a ground vote and faces a tough battle in the Senate. Similar efforts to strengthen antitrust standards or regulate algorithms have also failed.

“We have come to this point because of years of inactivity,” Senator Amy Klobuchar (D-MN) told The edge in an interview in January, describing a pending bill to prevent discrimination in app stores. “A lot of people talk a big game, but nothing went through.”

In response, many of the most pressing technical regulation challenges have fallen to the Federal Trade Commission. The committee is currently embroiled in an ongoing lawsuit to settle Meta’s acquisition of Instagram and WhatsApp, and filed a petition in July to prevent the company from acquiring a VR software studio. In the wake of the Supreme Court’s repeal of abortion rights, President Joe Biden also called on the commission to protect data that could endanger abortion seekers.