6750-01-P FEDERAL TRADE COMMISSION 16 CFR Part 464 Trade Regulation Rule on Commercial Surveillance and Data Security
Federal Trade Commission.
ACTION: Advance notice of proposed rulemaking; request for public comment; public forum.
publishing this advance notice of proposed rulemaking (“ANPR”) to request public comment on the prevalence of commercial surveillance and data security practices that harm consumers. Specifically, the Commission invites comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive.
DATES: Comments must be received on or before [60 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. The Public Forum will be held virtually on Thursday, September 8, 2022, from 2 p.m. until 7:30 p.m. Members of the public are invited to attend at the website https://www.ftc.gov/news-events/events/2022/09/commercial-surveillancedata-security-anpr-public-forum.
ADDRESSES: Interested parties may file a comment online or on paper by following the instructions in the Comment Submissions part of the SUPPLEMENTARY INFORMATION section below. Write “Commercial Surveillance ANPR, R111004” on your comment, and file your comment online at https://www.regulations.gov. If you prefer to file your comment on 1 paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue, NW, Suite CC-5610 (Annex B), Washington, DC 20580. FOR FURTHER INFORMATION CONTACT: James Trilling, 202-326-3497; Peder Magee, 202-326-3538; Olivier Sylvain, 202-326-3046; or commercialsurveillancerm@ftc.gov. I. Overview Whether they know it or not, most Americans today surrender their personal information to engage in the most basic aspects of modern life. When they buy groceries, do homework, or apply for car insurance, for example, consumers today likely give a wide range of personal information about themselves to companies, including their movements,1 prayers,2 friends, 3 menstrual cycles, 4 web-browsing,5 and faces,6 among other basic aspects of their lives. 1 See, e.g., Press Release, Fed. Trade Comm’n, Mobile Advertising Network InMobi Settles FTC Charges It Tracked Hundreds of Millions of Consumers’ Locations Without Permission (June 22, 2016), https://www.ftc.gov/newsevents/press-releases/2016/06/mobile-advertising-network-inmobi-settles-ftc-charges-it-tracked. See also Stuart A. Thompson & Charlie Warzel, Twelve Million Phones, One Dataset, Zero Privacy, N.Y. Times (Dec. 19, 2019), https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html; Jon Keegan & Alfred Ng, There’s a Multibillion-Dollar Market for Your Phone’s Location Data, The Markup (Sept. 30, 2021), https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data; Ryan Nakashima, AP Exclusive: Google Tracks Your Movements, Like It or Not, Associated Press (Aug. 13, 2018), https://apnews.com/article/north-america-science-technology-business-ap-top-news828aefab64d4411bac257a07c1af0ecb. 2 See, e.g., Joseph Cox, How the U.S. Military Buys Location Data from Ordinary Apps, Motherboard (Nov. 16, 2020), https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x. 3 See, e.g., Press Release, Fed. Trade Comm’n, Path Social Networking App Settles FTC Charges It Deceived Consumers and Improperly Collected Personal Information from Users’ Mobile Address Books (Feb. 1, 2013), https://www.ftc.gov/news-events/press-releases/2013/02/path-social-networking-app-settles-ftc-charges-it-deceived. 4 See, e.g., Press Release, Fed. Trade Comm’n, FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others (June 22, 2021), https://www.ftc.gov/newsevents/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared. 5 See, e.g., Fed. Trade Comm’n, A Look at What ISPs Know About You: Examining the Privacy Practices of Six Major Internet Service Providers: An FTC Staff Report (Oct. 21, 2021), https://www.ftc.gov/system/files/documents/reports/look-what-isps-know-about-you-examining-privacy-practicessix-major-internet-service-providers/p195402_isp_6b_staff_report.pdf. 6 See, e.g., Press Release, Fed. Trade Comm’n, FTC Finalizes Settlement with Photo App Developer Related to Misuse of Facial Recognition Technology (May 7, 2021), https://www.ftc.gov/news-events/pressreleases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse. See also Tom Simonite, Face Recognition Is Being Banned—but It’s Still Everywhere, Wired (Dec. 22, 2021), https://www.wired.com/story/facerecognition-banned-but-everywhere/. 2 Companies, meanwhile, develop and market products and services to collect and monetize this data. An elaborate and lucrative market for the collection, retention, aggregation, analysis, and onward disclosure of consumer data incentivizes many of the services and products on which people have come to rely. Businesses reportedly use this information to target services—namely, to set prices,7 curate newsfeeds,8 serve advertisements,9 and conduct research on people’s behavior,10 among other things. While, in theory, these personalization practices have the potential to benefit consumers, reports note that they have facilitated consumer harms that can be difficult if not impossible for any one person to avoid.11 7 See, e.g., Casey Bond, Target Is Tracking You and Changing Prices Based on Your Location, Huffington Post (Feb. 24, 2022), https://www.huffpost.com/entry/target-tracking-location-changingprices_l_603fd12bc5b6ff75ac410a38; Maddy Varner & Aaron Sankin, Suckers List: How Allstate’s Secret Auto Insurance Algorithm Squeezes Big Spenders, The MarkUp (Feb. 25, 2020), https://themarkup.org/allstatesalgorithm/2020/02/25/car-insurance-suckers-list. See generally Executive Office of the President of the United States, Big Data and Differential Pricing, at 2, 12-13 (Feb. 2015), https://obamawhitehouse.archives.gov/sites/default/files/whitehouse_files/docs/Big_Data_Report_Nonembargo_v2. pdf. 8 See, e.g., Will Oremus et al., Facebook under fire: How Facebook shapes your feed: The evolution of what posts get top billing on users’ news feeds, and what gets obscured, Wash. Post (Oct. 26, 2021), https://www.washingtonpost.com/technology/interactive/2021/how-facebook-algorithm-works/. 9 See, e.g., Nat Ives, Facebook Ad Campaign Promotes Personalized Advertising, Wall. St. J. (Feb. 25, 2021), https://www.wsj.com/articles/facebook-ad-campaign-promotes-personalized-advertising-11614261617. 10 See, e.g., Elise Hu, Facebook Manipulates Our Moods for Science and Commerce: A Roundup, NPR (June 30, 2014), https://www.npr.org/sections/alltechconsidered/2014/06/30/326929138/facebook-manipulates-our-moodsfor-science-and-commerce-a-roundup. 11 See, e.g., Matthew Hindman et al., Facebook Has a Superuser-Supremacy Problem, The Atlantic (Feb. 10, 2022), https://www.theatlantic.com/technology/archive/2022/02/facebook-hate-speech-misinformation-superusers/621617/; Consumer Protection Data Spotlight, Fed. Trade Comm’n, Social Media a Gold Mine for Scammers in 2021 (Jan. 25, 2022), https://www.ftc.gov/news-events/blogs/data-spotlight/2022/01/social-media-gold-mine-scammers-2021; Jonathan Stempel, Facebook Sued for Age, Gender Bias in Financial Services Ads, Reuters (Oct. 31, 2019), https://www.reuters.com/article/us-facebook-lawsuit-bias/facebook-sued-for-age-gender-bias-in-financial-servicesads-idUSKBN1XA2G8; Karen Hao, Facebook’s Ad Algorithms Are Still Excluding Women from Seeing Jobs, MIT Tech. Rev. (Apr. 9, 2021), https://www.technologyreview.com/2021/04/09/1022217/facebook-ad-algorithm-sexdiscrimination; Corin Faife & Alfred Ng, Credit Card Ads Were Targeted by Age, Violating Facebook’s AntiDiscrimination Policy, The MarkUp (Apr. 29, 2021), https://themarkup.org/citizen-browser/2021/04/29/credit-cardads-were-targeted-by-age-violating-facebooks-anti-discrimination-policy. Targeted behavioral advertising is not the only way in which internet companies automate advertising at scale. Researchers have found that contextual advertising may be as cost-effective as targeting, if not more so. See, e.g., Keach Hagey, Behavioral Ad Targeting Not Paying Off for Publishers, Study Suggests, Wall St. J. (May 29, 2019), https://www.wsj.com/articles/behavioralad-targeting-not-paying-off-for-publishers-study-suggests-11559167195 (discussing Veronica Marotta et al., Online Tracking and Publishers’ Revenues: An Empirical Analysis (2019), https://weis2019.econinfosec.org/wpcontent/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf). 3 Some companies, moreover, reportedly claim to collect consumer data for one stated purpose but then also use it for other purposes.12 Many such firms, for example, sell or otherwise monetize such information or compilations of it in their dealings with advertisers, data brokers, and other third parties.13 These practices also appear to exist outside of the retail consumer setting. Some employers, for example, reportedly collect an assortment of worker data to evaluate productivity, among other reasons14—a practice that has become far more pervasive since the onset of the COVID-19 pandemic.15 Many companies engage in these practices pursuant to the ostensible consent that they obtain from their consumers.16 But, as networked devices and online services become essential to navigating daily life, consumers may have little choice but to accept the terms that firms 12 See, e.g., Drew Harvell, Is Your Pregnancy App Sharing Your Intimate Data with Your Boss?, Wash. Post (Apr. 10, 2019), https://www.washingtonpost.com/technology/2019/04/10/tracking-your-pregnancy-an-app-may-be-morepublic-than-you-think/; Jon Keegan & Alfred Ng, The Popular Family Safety App Life360 Is Selling Precise Location Data on Its Tens of Millions of Users, The MarkUp (Dec. 6, 2021), https://themarkup.org/privacy/2021/12/06/the-popular-family-safety-app-life360-is-selling-precise-location-data-onits-tens-of-millions-of-user. 13 See, e.g., Fed. Trade Comm’n, Data Brokers: A Call for Transparency and Accountability (May 2014), https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federaltrade-commission-may-2014/140527databrokerreport.pdf. See also, e.g., Press Release, Fed. Trade Comm’n, FTC Puts an End to Data Broker Operation that Helped Scam More Than $7 Million from Consumers’ Accounts (Nov. 30, 2016), https://www.ftc.gov/news-events/press-releases/2016/11/ftc-puts-end-data-broker-operation-helpedscam-more-7-million; Press Release, Fed. Trade Comm’n, Data Broker Defendants Settle FTC Charges They Sold Sensitive Personal Information to Scammers (Feb. 18, 2016), https://www.ftc.gov/news-events/pressreleases/2016/02/data-broker-defendants-settle-ftc-charges-they-sold-sensitive. 14 See, e.g., Drew Harwell, Contract Lawyers Face a Growing Invasion of Surveillance Programs That Monitor Their Work, Wash. Post (Nov. 11, 2021), https://www.washingtonpost.com/technology/2021/11/11/lawyer-facialrecognition-monitoring/; Annie Palmer, Amazon Is Rolling Out Cameras That Can Detect If Warehouse Workers Are Following Social Distancing Rules, CNBC (June 16, 2020), https://www.cnbc.com/2020/06/16/amazon-usingcameras-to-enforce-social-distancing-rules-at-warehouses.html; Sarah Krouse, How Google Spies on Its Employees, The Information (Sept. 23, 2021), https://www.theinformation.com/articles/how-google-spies-on-its-employees; Adam Satariano, How My Boss Monitors Me While I Work From Home, N.Y. Times (May 6, 2020), https://www.nytimes.com/2020/05/06/technology/employee-monitoring-work-from-home-virus.html. 15 See, e.g., Danielle Abril & Drew Harwell, Keystroke tracking, screenshots, and facial recognition: The box may be watching long after the pandemic ends, Wash. Post (Sept. 24, 2021), https://www.washingtonpost.com/technology/2021/09/24/remote-work-from-home-surveillance/. 16 See Tr. of FTC Hr’g, The FTC’s Approach to Consumer Privacy (Apr. 9, 2019), at 50, https://www.ftc.gov/system/files/documents/public_events/1418273/ftc_hearings_session_12_transcript_day_1_4-9- 19.pdf (remarks of Paul Ohm). See also Fed. Trade Comm’n, Privacy Online: Fair Information Practices in the Electronic Marketplace: A Report to Congress 26 (May 2000), https://www.ftc.gov/sites/default/files/documents/reports/privacy-online-fair-information-practices-electronicmarketplace-federal-trade-commission-report/privacy2000.pdf. 4 offer.17 Reports suggest that consumers have become resigned to the ways in which companies collect and monetize their information, largely because consumers have little to no actual control over what happens to their information once companies collect it.18 In any event, the permissions that consumers give may not always be meaningful or informed. Studies have shown that most people do not generally understand the market for consumer data that operates beyond their monitors and displays.19 Most consumers, for example, know little about the data brokers and third parties who collect and trade consumer data or build consumer profiles20 that can expose intimate details about their lives and, in the wrong hands, could expose unsuspecting people to future harm.21 Many privacy notices that acknowledge such risks are reportedly not readable to the average consumer.22 Many consumers do not have the 17 See Tr. of FTC Hr’g, The FTC’s Approach to Consumer Privacy (Apr. 10, 2019), at 129, https://www.ftc.gov/system/files/documents/public_events/1418273/ftc_hearings_session_12_transcript_day_2_4- 10-19.pdf (remarks of FTC Commissioner Rebecca Kelly Slaughter, describing privacy consent as illusory because consumers often have no choice other than to consent in order to reach digital services that have become necessary for participation in contemporary society). 18 See Joe Nocera, How Cookie Banners Backfired, N.Y. Times (Jan. 29, 2022), https://www.nytimes.com/2022/01/29/business/dealbook/how-cookie-banners-backfired.html (discussing concept of “digital resignation” developed by Nora Draper and Joseph Turow). See also Nora A. Draper & Joseph Turow, The Corporate Cultivation of Digital Resignation, 21 New Media & Soc’y 1824-39 (2019). 19 See Neil Richards & Woodrow Hartzog, The Pathologies of Digital Consent, 96 Wash. U. L. Rev. 1461, 1477-78, 1498-1502 (2019); Daniel J. Solove, Introduction: Privacy Self-Management and the Consent Dilemma, 126 Harv. L. Rev. 1879, 1885-86 (2013) (“Solove Privacy Article”). 20 See generally Fed. Trade Comm’n, Data Brokers: A Call for Transparency and Accountability (May 2014), https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federaltrade-commission-may-2014/140527databrokerreport.pdf. 21 See, e.g., Press Release, Fed. Trade Comm’n, FTC Puts an End to Data Broker Operation that Helped Scam More Than $7 Million from Consumers’ Accounts (Nov. 30, 2016), https://www.ftc.gov/news-events/pressreleases/2016/11/ftc-puts-end-data-broker-operation-helped-scam-more-7-million; Press Release, Fed. Trade Comm’n, Data Broker Defendants Settle FTC Charges They Sold Sensitive Personal Information to Scammers (Feb. 18, 2016), https://www.ftc.gov/news-events/press-releases/2016/02/data-broker-defendants-settle-ftc-charges-theysold-sensitive; FTC v. Accusearch, 570 F.3d 1187, 1199 (10th Cir. 2009). See also Molly Olmstead, A Prominent Priest Was Outed for Using Grindr. Experts Say It’s a Warning Sign, Slate (July 21, 2021), https://slate.com/technology/2021/07/catholic-priest-grindr-data-privacy.html. 22 See Brooke Auxier et al., Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information, Pew Res. Ctr. (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/americansand-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/. See also Solove Privacy Article, 126 Harv. L. Rev. at 1885; Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S J. of L. & Pol’y for Info. Society 543 (2008); Irene Pollach, What’s Wrong with Online Privacy Policies?, 50 Comm’s ACM 103 (2007). 5 time to review lengthy privacy notices for each of their devices, applications, websites, or services,23 let alone the periodic updates to them. If consumers do not have meaningful access to this information, they cannot make informed decisions about the costs and benefits of using different services.24 This information asymmetry between companies and consumer runs even deeper. Companies can use the information that they collect to direct consumers’ online experiences in ways that are rarely apparent—and in ways that go well beyond merely providing the products or services for which consumers believe they sign up.25 The Commission’s enforcement actions have targeted several pernicious dark pattern practices, including burying privacy settings behind multiple layers of the user interface26 and making misleading representations to “trick or trap” consumers into providing personal information.27 In other instances, firms may misrepresent or fail to communicate clearly how they use and protect people’s data.28 Given the reported scale and pervasiveness of such practices, individual consumer consent may be irrelevant. 23 Kevin Litman-Navarro, We Read 150 Privacy Policies. They Were an Incomprehensible Disaster, N.Y. Times (2019), https://www.nytimes.com/interactive/2019/06/12/opinion/facebook-google-privacy-policies.html; Alexis C. Madrigal, Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Days, The Atlantic (Mar. 1, 2012), https://www.theatlantic.com/technology/archive/2012/03/reading-theprivacy-policies-you-encounter-in-ayear-would-take-76-work-days/253851/. See also FTC Comm’r Rebecca Kelly Slaughter, Wait But Why? Rethinking Assumptions About Surveillance Advertising: IAPP Privacy Security Risk Closing Keynote (“Slaughter Keynote”) (Oct. 22, 2021), at 4, https://www.ftc.gov/system/files/documents/public_statements/1597998/iapp_psr_2021_102221_final2.pdf. 24 See FTC Comm’r Christine S. Wilson, A Defining Moment for Privacy: The Time is Ripe for Federal Privacy Legislation, Remarks at the Future of Privacy Forum (Feb. 6, 2020), https://www.ftc.gov/newsevents/news/speeches/remarks-commissioner-christine-s-wilson-future-privacy-forum. 25 See generally Ryan Calo & Alex Rosenblat, The Taking Economy: Uber, Information, and Power, 117 Colum. L. Rev. 1623 (2017); Ryan Calo, Digital Market Manipulation, 82 Geo. Wash. L. Rev. 995 (2014). 26 See Press Release, Fed. Trade Comm’n, Facebook Settles FTC Charges That It Deceived Consumers by Failing to Keep Privacy Promises (Nov. 29, 2011), https://www.ftc.gov/news-events/press-releases/2011/11/facebook-settlesftc-charges-it-deceived-consumers-failing-keep. 27 See Press Release, Fed. Trade Comm’n, FTC Takes Action against the Operators of Copycat Military Websites (Sept. 6, 2018), https://www.ftc.gov/news-events/press-releases/2018/09/ftc-takes-action-against-operators-copycatmilitary-websites. 28 See generally infra Item III(a). 6 The material harms of these commercial surveillance practices may be substantial, moreover, given that they may increase the risks of cyberattack by hackers, data thieves, and other bad actors. Companies’ lax data security practices may impose enormous financial and human costs. Fraud and identity theft cost both businesses and consumers billions of dollars, and consumer complaints are on the rise.29 For some kinds of fraud, consumers have historically spent an average of 60 hours per victim trying to resolve the issue.30 Even the nation’s critical infrastructure is at stake, as evidenced by the recent attacks on the largest fuel pipeline,31 meatpacking plants,32 and water treatment facilities33 in the United States. Companies’ collection and use of data have significant consequences for consumers’ wallets, safety, and mental health. Sophisticated digital advertising systems reportedly automate the targeting of fraudulent products and services to the most vulnerable consumers.34 Stalking apps continue to endanger people.35 Children and teenagers remain vulnerable to cyber bullying, cyberstalking, and the distribution of child sexual abuse material.36 Peer-reviewed research has 29 Press Release, Fed. Trade Comm’n, New Data Shows FTC Received 2.8 Million Fraud Reports from Consumers in 2021 (Feb. 22, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/02/new-data-shows-ftcreceived-28-million-fraud-reports-consumers-2021-0. 30 Fed. Trade Comm’n, Identity Theft Survey Report (Sept. 2003), https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-identity-theftprogram/synovatereport.pdf. 31 William Turton & Kartikay Mehrotra, Hackers Breached Colonial Pipeline Using Compromised Password, Bloomberg (June 4, 2021), https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-usingcompromised-password. 32 Dan Charles, The Food Industry May Be Finally Paying Attention To Its Weakness To Cyberattacks, NPR (July 5, 2021), https://www.npr.org/2021/07/05/1011700976/the-food-industry-may-be-finally-paying-attention-to-itsweakness-to-cyberattack. 33 Josh Margolin & Ivan Pereira, Outdated Computer System Exploited in Florida Water Treatment Plant Hack, ABC News (Feb. 11, 2021), https://abcnews.go.com/US/outdated-computer-system-exploited-florida-watertreatment-plant/story?id=75805550. 34 See, e.g., Zeke Faux, How Facebook Helps Shady Advertisers Pollute the Internet, Bloomberg (Mar. 27, 2019), https://www.bloomberg.com/news/features/2018-03-27/ad-scammers-need-suckers-and-facebook-helps-find-them (noting an affiliate marketer’s claim that Facebook ‘s ad system “find[s] the morons for me”). 35 See Consumer Advice, Fed. Trade Comm’n, Stalking Apps: What to Know (May 2021), https://consumer.ftc.gov/articles/stalking-apps-what-know. 36 See Ellen M. Selkie, Jessica L. Fales, & Megan A. Moreno, Cyberbullying Prevalence Among U.S. Middle and High School-Aged Adolescents: A Systematic Review and Quality Assessment, 58 J. Adolescent Health 125 (2016); Fed. Trade Comm’n, Parental Advisory: Dating Apps (May 6, 2019), https://consumer.ftc.gov/consumer7 linked social media use with depression, anxiety, eating disorders, and suicidal ideation among kids and teens.37 Finally, companies’ growing reliance on automated systems is creating new forms and mechanisms for discrimination based on statutorily protected categories,38 including in critical alerts/2019/05/parental-advisory-dating-apps; Subcommittee on Consumer Protection, Product Safety, and Data Security, U.S. Senate Comm. on Com., Sci. & Transp., Hearing, Protecting Kids Online: Internet Privacy and Manipulative Marketing (May 18, 2021), https://www.commerce.senate.gov/2021/5/protecting-kids-online-internetprivacy-and-manipulative-marketing; Aisha Counts, Child Sexual Abuse Is Exploding Online. Tech’s Best Defenses Are No Match., Protocol (Nov. 12, 2021), https://www.protocol.com/policy/csam-child-safety-online. 37 See, e.g., Elroy Boers et al., Association of Screen Time and Depression in Adolescence, 173 JAMA Pediatr. 9 (2019) at 857 (“We found that high mean levels of social media over 4 years and any further increase in social media use in the same year were associated with increased depression.”); Hugues Sampasa-Kanyinga & Rosamund F. Lewis, Frequent Use of Social Networking Sites Is Associated with Poor Psychological Functioning Among Children and Adolescents, 18 Cyberpsychology, Behavior, and Social Networking 7 (2015) at 380 (“Daily [social networking site] use of more than 2 hours was. . . independently associated with poor self-rating of mental health and experiences of high levels of psychological distress and suicidal ideation.”); Jean M. Twenge et al., Increases in Depressive Symptoms, Suicide-Related Outcomes, and Suicide Rates Among U.S. Adolescents After 2010 and Links to Increased New Media Screen Time, 6 Clinical Psychological Sci. 1 (2018) at 11 (“[A]dolescents using social media sites every day were 13% more likely to report high levels of depressive symptoms than those using social media less often.”); H.C. Woods & H. Scott, #Sleepyteens: Social Media Use in Adolescence is Associated with Poor Sleep Quality, Anxiety, Depression, and Low Self-Esteem, 51 J. of Adolescence 41-9 (2016) at 1 (“Adolescents who used social media more . . . experienced poorer sleep quality, lower self-esteem and higher levels of anxiety and depression.”); Simon M. Wilksch et al., The relationship between social media use and disordered eating in young adolescents, 53 Int’l J. of Eating Disorders 1 at 96 (“A clear pattern of association was found between [social media] usage and [disordered eating] cognitions.”). 38 A few examples of where automated systems may have produced disparate outcomes include inaccuracies and delays in the delivery of child welfare services for the needy; music streaming services that are more likely to recommend men than women; gunshot detection software that mistakenly alerts local police when people light fireworks in majority-minority neighborhoods; search engine results that demean black women; and face recognition software that is more likely to misidentify dark-skinned women than light-skinned men. See Joy Buolamwini & Timnit Gebru, Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification, 81 Proc. of Mach. Learning Res. (2018); Latanya Sweeney, Discrimination in Online Ad Delivery: Google Ads, Black Names and White Names, Racial Discrimination, and Click Advertising, 11 Queue 10, 29 (Mar. 2013); Muhammad Ali et al., Discrimination Through Optimization: How Facebook’s Ad Delivery Can Lead to Skewed Outcomes, 3 Proc. ACM on Hum.-Computer Interaction (2019); Virginia Eubanks, Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor (2018); Andres Ferraro, Xavier Serra, & Christine Bauer, Break the Loop: Gender Imbalance in Music Recommenders, CHIIR ’21: Proceedings of the 2021 Conference on Human Information Interaction and Retrieval, 249-254 (Mar. 2021), https://dl.acm.org/doi/proceedings/10.1145/3406522. See generally Anita Allen, Dismantling the “Black Opticon”: Privacy, Race, Equity, and Online Data-Protection Reform, 131 Yale L. J. Forum 907 (2022), https://www.yalelawjournal.org/pdf/F7.AllenFinalDraftWEB_6f26iyu6.pdf; Safiya Umoja Noble, Algorithms of Oppression: How Search Engines Reinforce Racism (2018); Danielle Citron, Hate Crimes in Cyberspace (2014). 8 areas such as housing,39 employment,40 and healthcare.41 For example, some employers’ automated systems have reportedly learned to prefer men over women.42 Meanwhile, a recent investigation suggested that lenders’ use of educational attainment in credit underwriting might disadvantage students who attended historically Black colleges and universities.43 And the Department of Justice recently settled its first case challenging algorithmic discrimination under the Fair Housing Act for a social media advertising delivery system that unlawfully discriminated based on protected categories.44 Critically, these kinds of disparate outcomes may arise even when automated systems consider only unprotected consumer traits. 45 39 See Ny Magee, Airbnb Algorithm Linked to Racial Disparities in Pricing, The Grio (May 13, 2021), https://thegrio.com/2021/05/13/airbnb-racial-disparities-in-pricing/; Emmanuel Martinez & Lauren Kirchner, The Secret Bias Hidden in Mortgage-Approval Algorithms, ABC News & The MarkUp (Aug. 25, 2021), https://abcnews.go.com/Business/wireStory/secret-bias-hidden-mortgage-approval-algorithms-79633917. See generally Fed. Trade Comm’n, Accuracy in Consumer Reporting Workshop (Dec. 10, 2019), https://www.ftc.gov/news-events/events-calendar/accuracy-consumer-reporting-workshop. See also Alex P. Miller & Kartik Hosanagar, How Targeted Ads and Dynamic Pricing Can Perpetuate Bias, Harv. Bus. Rev. (Nov. 8, 2019), https://hbr.org/2019/11/how-targeted-ads-and-dynamic-pricing-can-perpetuate-bias. 40 See Ifeoma Ajunwa, The “Black Box” at Work, Big Data & Society (Oct. 19, 2020), https://journals.sagepub.com/doi/full/10.1177/2053951720938093. 41 See Donna M. Christensen et al., Medical Algorithms are Failing Communities of Color, Health Affs. (Sept. 9, 2021), https://www.healthaffairs.org/do/10.1377/hblog20210903.976632/full/; Heidi Ledford, Millions of Black People Affected by Racial Bias in Health-Care Algorithms, Nature (Oct. 24, 2019), https://www.nature.com/articles/d41586-019-03228-6/. 42 Jeffrey Dastin, Amazon scraps secret AI recruiting tool that showed bias against women, Reuters (Oct. 10, 2018), https://www.reuters.com/article/us-amazon-com-jobs-automation-insight/amazon-scraps-secret-ai-recruiting-toolthat-showed-bias-against-women-idUSKCN1MK08G; Dave Gershgorn, Companies are on the hook if their hiring algorithms are biased, Quartz (Oct. 22, 2018), https://qz.com/1427621/companies-are-on-the-hook-if-their-hiringalgorithms-are-biased/. 43 Katherine Welbeck & Ben Kaufman, Fintech Lenders’ Responses to Senate Probe Heighten Fears of Educational Redlining, Student Borrower Prot. Ctr. (July 31, 2020), https://protectborrowers.org/fintech-lenders-response-tosenate-probe-heightens-fears-of-educational-redlining/. This issue is currently being investigated by the company and outside parties. Relman Colfax, Fair Lending Monitorship of Upstart Network’s Lending Model, https://www.relmanlaw.com/cases-406. 44 Compl., United States v. Meta Platforms, Inc., No. 22-05187 (S.D.N.Y. filed June 21, 2022), https://www.justice.gov/usao-sdny/press-release/file/1514051/download; Settlement Agreement, United States v. Meta Platforms, Inc., No. 22-05187 (S.D.N.Y. filed June 21, 2022), https://www.justice.gov/crt/casedocument/file/1514126/download. 45 Andrew Selbst, A New HUD Rule Would Effectively Encourage Discrimination by Algorithm, Slate (Aug. 19, 2019), https://slate.com/technology/2019/08/hud-disparate-impact-discrimination-algorithm.html. See also Rebecca Kelly Slaughter, Algorithms and Economic Justice, 23 Yale J. L. & Tech. 1, 11-14 (2021) (“Slaughter Algorithms Paper”); Anupam Chander, The Racist Algorithm?, 115 Mich. L. Rev. 1023, 1029-30, 1037-39 (2017); Solon Barocas & Andrew D. Selbst, Big Data’s Disparate Impact, 104 Calif. L. Rev. 671, 677-87 (2016). 9 The Commission is issuing this ANPR pursuant to Section 18 of the Federal Trade Commission Act (“FTC Act”) and the Commission’s Rules of Practice46 because recent Commission actions, news reporting, and public research suggest that harmful commercial surveillance and lax data security practices may be prevalent and increasingly unavoidable.47 These developments suggest that trade regulation rules reflecting these current realities may be needed to ensure Americans are protected from unfair or deceptive acts or practices. New rules could also foster a greater sense of predictability for companies and consumers and minimize the uncertainty that case-by-case enforcement may engender. Countries around the world and states across the nation have been alert to these concerns. Many accordingly have enacted laws and regulations that impose restrictions on companies’ collection, use, analysis, retention, transfer, sharing, and sale or other monetization of consumer data. In recognition of the complexity and opacity of commercial surveillance practices today, such laws have reduced the emphasis on providing notice and obtaining consent and have instead 46 15 U.S.C. 57a; 16 CFR parts 0 and 1. 47 In May 2022, three consumer advocacy groups urged the Commission to commence a rulemaking proceeding to protect “privacy and civil rights.” See Letter of Free Press, Access Now, and UltraViolet to Chair Lina M. Khan (May 12, 2022), https://act.freepress.net/sign/protect_privacy_civil_rights. Late in 2021, moreover, the Commission received a petition that calls on it to promulgate rules pursuant to its authority to protect against unfair methods of competition in the market for consumer data. See Press Release, Accountable Tech, Accountable Tech Petitions FTC to Ban Surveillance Advertising as an ‘Unfair Method of Competition’ (Sept. 28, 2021), https://accountabletech.org/media/accountable-tech-petitions-ftc-to-ban-surveillance-advertising-as-an-unfairmethod-of-competition/. In accordance with the provision of its Rules of Practice concerning public petitions, 16 CFR 1.31, the Commission published a notice about the petition, 86 FR 73206 (Dec. 23, 2021), and accepted public comments, which are compiled at https://www.regulations.gov/docket/FTC-2021-0070/comments. The petitioner urges new rules that address the way in which certain dominant companies exploit their access to and control of consumer data. Those unfair-competition concerns overlap with some of the concerns in this ANPR about unfair or deceptive acts or practices, and several comments in support of the petition also urged the Commission to pursue a rulemaking using its authority to regulate unfair or deceptive practices. See, e.g., Cmt. of Consumer Reports & Elec. Privacy Info. Ctr., at 2 (Jan. 27, 2022), https://downloads.regulations.gov/FTC-2021-0070-0009/attachment_1.pdf. Accordingly, Item IV, below, invites comment on the ways in which existing and emergent commercial surveillance practices harm competition and on any new trade regulation rules that would address such practices. Such rules could arise from the Commission’s authority to protect against unfair methods of competition, so they may be proposed directly without first being subject of an advance notice of proposed rulemaking. See 15 U.S.C. 57a(a)(2) (Section 18’s procedural requirements, including an ANPR, apply to rules defining unfair or deceptive acts or practices but expressly do not apply to rules “with respect to unfair methods of competition”). 10 stressed additional privacy “defaults” as well as increased accountability for businesses and restrictions on certain practices. For example, European Union (“EU”) member countries enforce the EU’s General Data Protection Regulation (“GDPR”),48 which, among other things, limits the processing of personal data to six lawful bases and provides consumers with certain rights to access, delete, correct, and port such data. Canada’s Personal Information Protection and Electronic Documents Act49 and Brazil’s General Law for the Protection of Personal Data50 contain some similar rights.51 Laws in California,52 Virginia, 53 Colorado,54 Utah,55 and Connecticut,56 moreover, include some comparable rights, and numerous state legislatures are considering similar laws. Alabama,57 Colorado,58 and Illinois,59 meanwhile, have enacted laws related to the development and use of 48 See Data Protection in the EU, Eur. Comm’n, https://ec.europa.eu/info/law/law-topic/data-protection/dataprotection-eu_en. 49 See Personal Information Protection and Electronic Documents Act (PIPEDA), Off. of the Privacy Comm’r of Can., https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-andelectronic-documents-act-pipeda/ (last modified Dec. 8, 2021). 50 Brazilian General Data Protection Law (Law No. 13,709, of Aug. 14, 2018), https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/. 51 In 2021, the European Commission also announced proposed legislation to create additional rules for artificial intelligence that would, among other things, impose particular documentation, transparency, data management, recordkeeping, security, assessment, notification, and registration requirements for certain artificial intelligence systems that pose high risks of causing consumer injury. See Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts, COM (2021) 206 final (Apr. 21, 2021), https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX%3A52021PC0206. 52 See California Privacy Rights Act of 2020, Proposition 24 (Cal. 2020) (codified at Cal. Civ. Code 1798.100 - 199.100); State of Cal. Dep’t of Just., California Consumer Privacy Act (CCPA): Frequently Asked Questions (FAQs), https://oag.ca.gov/privacy/ccpa. 53 See Consumer Data Protection Act, S.B. 1392, 161st Gen. Assem. (Va. 2021) (codified at Va. Code Ann. 59.1- 575 through 59.1-585 (2021)). 54 See Protect Personal Data Privacy Act, 21 S.B. 190, 73 Gen. Assem. (Colo. 2021). 55 See Utah Consumer Privacy Act, 2022 Utah Laws 462 (codified at Utah Code Ann. 13-61-1 through 13-61-4). 56 See An Act Concerning Personal Data Privacy and Online Monitoring, 2022 Conn. Acts P.A. 22-15 (Reg. Sess.). 57 See Act. No. 2021-344, S.B. 78, 2021 Leg., Reg. Sess., (Ala. 2021). 58 See Restrict Insurers’ Use of External Consumer Data Act, 21 S.B. 169, 73rd Gen. Assem., 1st Reg. Sess. (Colo. 2021). 59 See Artificial Intelligence Video Interview Act, H.B. 53, 102nd Gen. Assem., Reg. Sess. (Ill. 2021) (codified at 820 Ill. Comp. Stat. Ann. 42/1 et seq.). 11 artificial intelligence. Other states, including Illinois,60 Texas,61 and Washington,62 have enacted laws governing the use of biometric data. All fifty U.S. states have laws that require businesses to notify consumers of certain breaches of consumers’ data.63 And numerous states require businesses to take reasonable steps to secure consumers’ data.64 Through this ANPR, the Commission is beginning to consider the potential need for rules and requirements regarding commercial surveillance and lax data security practices. Section 18 of the FTC Act authorizes the Commission to promulgate, modify, and repeal trade regulation rules that define with specificity acts or practices that are unfair or deceptive in or affecting commerce within the meaning of Section 5(a)(1) of the FTC Act.65 Through this ANPR, the Commission aims to generate a public record about prevalent commercial surveillance practices or lax data security practices that are unfair or deceptive, as well as about efficient, effective, and adaptive regulatory responses. These comments will help to sharpen the Commission’s enforcement work and may inform reform by Congress or other policymakers, even if the Commission does not ultimately promulgate new trade regulation rules.66 The term “data security” in this ANPR refers to breach risk mitigation, data management and retention, data minimization, and breach notification and disclosure practices. 60 See Biometric Information Privacy Act, S.B. 2400, 2008 Gen. Assem., Reg. Sess. (Ill. 2021) (codified at 740 Ill. Comp. Stat. Ann. 14/1 et seq.). 61 See TEX. BUS. & COM. CODE 503.001. 62 See Wash. Rev. Code Ann. 19.375.010 through 19.375.900. 63 See Nat’l Conf. of State Leg., Security Breach Notification Laws (Jan. 17, 2022), https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notificationlaws.aspx. 64 See Nat’l Conf. of State Leg., Data Security Laws, Private Sector (May 29, 2019), https://www.ncsl.org/research/telecommunications-and-information-technology/data-security-laws.aspx. 65 15 U.S.C. 45(a)(1). 66 Cf. Slaughter Keynote at 4; Oral Statement of Comm’r Christine S. Wilson, Strengthening the Federal Trade Commission’s Authority to Protect Consumers: Hearing before the Senate Comm. on Com., Sci. & Transp. (Apr. 20, 2021), https://www.ftc.gov/system/files/documents/public_statements/1589180/opening_statement_final_for_postingrevd.p df. 12 For the purposes of this ANPR, “commercial surveillance” refers to the collection, aggregation, analysis, retention, transfer, or monetization of consumer data and the direct derivatives of that information. These data include both information that consumers actively provide—say, when they affirmatively register for a service or make a purchase—as well as personal identifiers and other information that companies collect, for example, when a consumer casually browses the web or opens an app. This latter category is far broader than the first. The term “consumer” as used in this ANPR includes businesses and workers, not just individuals who buy or exchange data for retail goods and services. This approach is consistent with the Commission’s longstanding practice of bringing enforcement actions against firms that harm companies67 as well as workers of all kinds.68 The FTC has frequently used Section 5 of the FTC Act to protect small businesses or individuals in contexts involving their employment or independent contractor status.69 67 See, e.g., Press Release, Fed. Trade Comm’n, FTC Obtains Contempt Ruling Against ‘Yellow Pages’ Scam (Nov. 25, 2015), https://www.ftc.gov/news-events/press-releases/2015/11/ftc-obtains-contempt-ruling-against-yellowpages-scam; Press Release, Fed. Trade Comm’n, FTC and Florida Halt Internet ‘Yellow Pages’ Scammers (July 17, 2014), https://www.ftc.gov/news-events/press-releases/2014/07/ftc-florida-halt-internet-yellow-pages-scammers; In re Spiegel, Inc., 86 F.T.C. 425, 439 (1975). See also FTC v. Sperry & Hutchinson Co., 405 U.S. 233, 244 (1972); FTC v. Bunte Bros., Inc., 312 U.S. 349, 353 (1941); In re Orkin Exterminating Co., Inc., 108 F.T.C. 263 (1986), aff’d, Orkin Exterminating Co., Inc. v. FTC, 849 F.2d 1354 (11th Cir. 1988); FTC v. Datacom Mktg., Inc., No. 06-c2574, 2006 WL 1472644, at *2 (N.D. Ill. May 24, 2006). Previously, the Commission included “businessmen” among those Congress charged it to protect under the statute. See Fed. Trade Comm’n, FTC Policy Statement on Unfairness (Dec. 17, 1980), appended to In re Int’l Harvester Co., 104 F.T.C. 949, 1072 n.8 (1984), https://www.ftc.gov/public-statements/1980/12/ftc-policy-statement-unfairness. 68 See, e.g., Press Release, Fed. Trade Comm’n, FTC Settles Charges Against Two Companies That Allegedly Failed to Protect Sensitive Employee Data (May 3, 2011), https://www.ftc.gov/news-events/pressreleases/2011/05/ftc-settles-charges-against-two-companies-allegedly-failed; Press Release, Fed. Trade Comm’n, Rite Aid Settles FTC Charges That It Failed to Protect Medical and Financial Privacy of Customers and Employees (July 27, 2010), https://www.ftc.gov/news-events/press-releases/2010/07/rite-aid-settles-ftc-charges-it-failedprotect-medical-financial; Press Release, Fed. Trade Comm’n, CVS Caremark Settles FTC Charges: Failed to Protect Medical and Financial Privacy of Customers and Employees; CVS Pharmacy Also Pays $2.25 Million to Settle Allegations of HIPAA Violations (Feb. 18, 2009), https://www.ftc.gov/news-events/pressreleases/2009/02/cvs-caremark-settles-ftc-chargesfailed-protect-medical-financial. See also Press Release, Fed. Trade Comm’n, Amazon To Pay $61.7 Million to Settle FTC Charges It Withheld Some Customer Tips from Amazon Flex Drivers (Feb. 2, 2021), https://www.ftc.gov/news-events/press-releases/2021/02/amazon-pay-617- million-settle-ftc-charges-it-withheld-some. 69 See, e.g., FTC v. IFC Credit Corp., 543 F. Supp. 2d 925, 934-41 (N.D. Ill. 2008) (holding that the FTC’s construction of the term “consumer” to include businesses as well as individuals is reasonable and is supported by the text and history of the FTC Act). 13 This ANPR proceeds as follows. Item II outlines the Commission’s existing authority to bring enforcement actions and promulgate trade regulation rules under the FTC Act. Item III sets out the wide range of actions against commercial surveillance and data security acts or practices that the Commission has pursued in recent years as well as the benefits and shortcomings of this case-by-case approach. Item IV sets out the questions on which the Commission seeks public comment. Finally, Item V provides instructions on the comment submission process, and Item VI describes a public forum that is scheduled to take place to facilitate public involvement in this rulemaking proceeding. II. The Commission’s Authority Congress authorized the Commission to propose a rule defining unfair or deceptive acts or practices with specificity when the Commission “has reason to believe that the unfair or deceptive acts or practices which are the subject of the proposed rulemaking are prevalent.”70 A determination about prevalence can be made either on the basis of “cease-and-desist” orders regarding such acts or practices that the Commission has previously issued, or when it has “any other information” that “indicates a widespread pattern of unfair or deceptive acts or practices.”71 Generally, a practice is unfair under Section 5 if (1) it causes or is likely to cause substantial injury, (2) the injury is not reasonably avoidable by consumers, and (3) the injury is not outweighed by benefits to consumers or competition.72 A representation, omission, or practice is deceptive under Section 5 if it is likely to mislead consumers acting reasonably under the circumstances and is material to consumers—that is, it would likely affect the consumer’s 70 15 U.S.C. 57a(b)(3). 71 Id. 72 15 U.S.C. 45(n). 14 conduct or decision with regard to a product or service.73 Under the statute, this broad language is applied to specific commercial practices through Commission enforcement actions and the promulgation of trade regulation rules. In addition to the FTC Act, the Commission enforces a number of sector-specific laws that relate to commercial surveillance practices, including: the Fair Credit Reporting Act,74 which protects the privacy of consumer information collected by consumer reporting agencies; the Children’s Online Privacy Protection Act (“COPPA”),75 which protects information collected online from children under the age of 13; the Gramm-Leach-Bliley Act (“GLBA”),76 which protects the privacy of customer information collected by financial institutions; the Controlling the Assault of Non-Solicited Pornography and Marketing (“CAN-SPAM”) Act,77 which allows consumers to opt out of receiving commercial email messages; the Fair Debt Collection Practices Act,78 which protects individuals from harassment by debt collectors and imposes disclosure requirements on related third-parties; the Telemarketing and Consumer Fraud and Abuse Prevention Act,79 under which the Commission implemented the Do Not Call Registry80; the Health Breach Notification Rule,81 which applies to certain health information; and the Equal Credit Opportunity Act,82 which protects individuals from discrimination on the basis of race, color, religion, national origin, sex, marital status, receipt of public assistance, or good faith 73 See FTC Policy Statement on Deception (Oct. 14, 1983), appended to In re Cliffdale Assocs., Inc., 103 F.T.C. 110, 174 (1984), https://www.ftc.gov/system/files/documents/public_statements/410531/831014deceptionstmt.pdf. 74 15 U.S.C. 1681 through 1681x. 75 15 U.S.C. 6501 through 6506. 76 Pub. L. No. 106-102, 113 Stat. 1338 (1999) (codified as amended in scattered sections of 12 and 15 U.S.C.). 77 15 U.S.C. 7701 through 7713. 78 15 U.S.C. 1692 through 1692p. 79 15 U.S.C. 6101 through 6108. 80 16 CFR part 310. 81 16 CFR part 318. 82 15 U.S.C. 1691 through 1691f. 15 exercise of rights under the Consumer Credit Protection Act and requires creditors to provide to applicants, upon request, the reasons underlying decisions to deny credit. III. The Commission’s Current Approach to Privacy and Data Security a. Case-By-Case Enforcement and General Policy Work For more than two decades, the Commission has been the nation’s privacy agency, engaging in policy work and bringing scores of enforcement actions concerning data privacy and security.83 These actions have alleged that certain practices violate Section 5 of the FTC Act or other statutes to the extent they pose risks to physical security, cause economic or reputational injury, or involve unwanted intrusions into consumers’ daily lives.84 For example, the Commission has brought actions for: • the surreptitious collection and sale of consumer phone records obtained through false pretenses85; • the public posting of private health-related data online86; 83 “Since 1995, the Commission has been at the forefront of the public debate on online privacy.” Fed. Trade Comm’n, Privacy Online: Fair Information Practices in the Electronic Marketplace—A Report to Congress 3 (2000), http://www.ftc.gov/reports/privacy2000/privacy2000.pdf (third consecutive annual report to Congress after it urged the Commission to take on a greater role in policing privacy practices using Section 5 as the internet grew from a niche service to a mainstream utility). The first online privacy enforcement action came in 1998 against GeoCities, “one of the most popular sites on the World Wide Web.” Press Release, Fed. Trade Comm’n, Internet Site Agrees to Settle FTC Charges of Deceptively Collecting Personal Information in Agency’s First Internet Privacy Case (Aug. 13, 1998), http://www.ftc.gov/news-events/press-releases/1998/08/internet-site-agrees-settle-ftccharges-deceptively-collecting. 84 See Fed. Trade Comm’n, Comment to the National Telecommunications & Information Administration on Developing the Administration’s Approach to Consumer Privacy, No. 180821780-8780-01, 8-9 (Nov. 9, 2018), https://www.ftc.gov/system/files/documents/advocacy_documents/ftc-staff-comment-ntiadevelopingadministrations-approach-consumer-privacy/p195400_ftc_comment_to_ntia_112018.pdf; FTC Comm’r Christine S. Wilson, A Defining Moment for Privacy: The Time Is Ripe for Federal Privacy Legislation: Remarks at the Future of Privacy Forum 11, n.39 (Feb. 6, 2020), https://www.ftc.gov/system/files/documents/public_statements/1566337/commissioner_wilson_privacy_forum_spee ch_02-06-2020.pdf. 85 See, e.g., Compl. for Injunctive and Other Equitable Relief, United States v. Accusearch, Inc., No. 06-cv-105 (D. Wyo. filed May 1, 2006), https://www.ftc.gov/sites/default/files/documents/cases/2006/05/060501accusearchcomplaint.pdf. 86 See, e.g., Compl., In re Practice Fusion, Inc., F.T.C. File No. 142-3039 (Aug. 16, 2016), https://www.ftc.gov/system/files/documents/cases/160816practicefusioncmpt.pdf. 16 • the sharing of private health-related data with third parties87; • inaccurate tenant screening88; • public disclosure of consumers’ financial information in responses to consumers’ critical online reviews of the publisher’s services89; • pre-installation of ad-injecting software that acted as a man-in-the-middle between consumers and all websites with which they communicated and collected and transmitted to the software developer consumers’ internet browsing data90; • solicitation and online publication of “revenge porn”—intimate pictures and videos of ex-partners, along with their personal information—and the collection of fees to take down such information91; • development and marketing of “stalkerware” that purchasers surreptitiously installed on others’ phones or computers in order to monitor them92; 87 See, e.g., Decision and Order, In re Flo Health, Inc., FTC File No. 1923133 (June 22, 2021), www.ftc.gov/system/files/documents/cases/192_3133_flo_health_decision_and_order.pdf. 88 See, e.g., Compl. for Civ. Penalties, Permanent Injunction, and Other Equitable Relief, United States v. AppFolio, Inc., No. 1:20-cv-03563 (D.D.C. filed Dec. 8, 2020), https://www.ftc.gov/system/files/documents/cases/ecf_1_- _us_v_appfolio_complaint.pdf. 89 See, e.g., Compl., United States v. Mortg. Sols. FCS, Inc., No. 4:20-cv-00110 (N.D. Cal. filed Jan. 6, 2020), https://www.ftc.gov/system/files/documents/cases/mortgage_solutions_complaint.pdf. 90 See, e.g., Decision and Order, In re Lenovo (United States) Inc., FTC File No. 152 3134 (Dec. 20, 2017), https://www.ftc.gov/system/files/documents/cases/152_3134_c4636_lenovo_united_states_decision_and_order.pdf. 91 See, e.g., Compl. for Permanent Injunction and Other Equitable Relief, FTC and State of Nevada v. EMP Media, Inc., No. 2:18-cv-00035 (D. Nev. filed Jan. 9, 2018), https://www.ftc.gov/system/files/documents/cases/1623052_myex_complaint_1-9-18.pdf; Compl., In re Craig Brittain, F.T.C. File No. 132-3120 (Dec. 28, 2015), https://www.ftc.gov/system/files/documents/cases/160108craigbrittaincmpt.pdf. 92 See, e.g., Compl., In re Support King, LLC, F.T.C. File No. 192-3003 (Dec. 20, 2021), https://www.ftc.gov/system/files/documents/cases/1923003c4756spyfonecomplaint_0.pdf; Compl., In re Retina-X Studios, LLC, F.T.C. File No. 172-3118 (Mar. 26, 2020), https://www.ftc.gov/system/files/documents/cases/172_3118_retina-x_studios_complaint_0.pdf; Compl. for Permanent Injunction and Other Equitable Relief, FTC v. CyberSpy Software, LLC., No. 6:08-cv-01872 (M.D. Fla. filed Nov. 5, 2008), https://www.ftc.gov/sites/default/files/documents/cases/2008/11/081105cyberspycmplt.pdf. 17 • retroactive application of material privacy policy changes to personal information that businesses previously collected from users93; • distribution of software that caused or was likely to cause consumers to unwittingly share their files publicly94; • surreptitious activation of webcams in leased computers placed in consumers’ homes95; • sale of sensitive data such as Social Security numbers to third parties who did not have a legitimate business need for the information,96 including known fraudsters97; • collection and sharing of sensitive television-viewing information to target advertising contrary to reasonable expectations98; • collection of phone numbers and email addresses to improve social media account security, but then deceptively using that data to allow companies to target advertisements in violation of an existing consent order99;