Blog
FTC Recommends Targeted Data Tracking Legislation and Self-Regulatory Codes
Blog
April 5, 2012
On March 26, the FTC released a final report with a framework for consumer privacy. The framework and report has recommendations to lawmakers and businesses alike. In the report, the FTC focused on five key areas: (1) do-not-track; (2) mobile privacy and the development of easy-to-read disclosures; (3) data-broker collection and use of consumer information; (4) tracking of consumer activity by large platforms like ISP, browsers or social media providers; and (5) self-regulatory codes and promoting the enforceability of such programs. As part of its final report, the FTC called on Congress "to consider enacting general privacy legislation, data security and breach notification legislation," including legislation to allow consumers to access their personal information collected by data brokers. The FTC also stressed that companies should adopt more effective notice and choice mechanisms, and give greater transparency with regard to data collection practices. The FTC also noted that large platforms such as ISPs, browsers, operating systems, and social networks present heightened security concerns which hints at the possibility of developing new privacy standards for large platforms. The FTC plans to host a public workshop later this year on large platforms tracking, and will host a workshop on May 30th which will address how to make mobile privacy disclosures "short, effective, and accessible to consumers on small screens." The FTC also narrowed its initial privacy framework scope. Initially it had indicating that the framework should be followed by all commercial entities that collect or use consumer data that is reasonably linked to a specific individual. In the final report, the FTC excluded companies that have only non-sensitive data from fewer than 5,000 consumers per year, and that do not share this data with third parties.
TIP: This report not only suggests areas where we may see more legislation, but also where the FTC will be more active in its current enforcement activities – even absent such legislation. Companies should thus ensure they have programs in place to provide appropriate choice, for example in a behavioral advertising context, and that they have easy-to-read privacy policies for mobile sites and apps. In addition, to the extent that enforceable industry codes are developed, companies are encouraged to take part in these discussions and help shape any such codes that are developed.
This entry has been created for information and planning purposes. It is not intended to be, nor should it be substituted for, legal advice, which turns on specific facts.