Reed Smith Client Alerts

The Federal Trade Commission (“FTC”) recently announced an advanced notice of public rulemaking (“ANPR”) and request for public comment regarding what it refers to as, “commercial surveillance” and “lax security practices.” Notably, the FTC’s definition of “commercial surveillance”—the “pervasive collection, tracking, and monetization of personal data”—is extremely broad. Both the breadth and ambiguity of the notice may complicate the successful promulgation of any final rules under the agency’s limited Magnuson-Moss rulemaking authority.

The ANPR comes at a contentious time for the FTC. The agency has suffered stinging defeats in court recently, including the Supreme Court decision in AMG Capital Management, LLC v. FTC, in which the Supreme Court unanimously held that the Commission has been unconstitutionally violating its statutory authority by seeking monetary relief under Section 13(b) of the FTC Act. Two commissioners dissented from the ANPR, which was issued at a time when FTC Chair Lina Khan (“Khan”) has been taking aim at what the agency refers to as “surveillance-based business models.” In recent months, leading tech brands and the Chamber of Commerce have resorted to the courts to contest new and aggressive agency investigative and enforcement practices. If rulemaking on the ANPR goes forward, it appears that the FTC will continue its pursuit of the technology industry by looking to aggressively limit—and in some instances foreclose altogether—data collection and usage practices that Congress has thus far declined to regulate. The FTC will also likely use any new, industry-wide rules as a novel hook for seeking monetary relief from companies.

Magnuson-Moss Rulemaking in the Khan Era: A Hammer Looking for a Nail?

The FTC’s present efforts to utilize its limited rulemaking authority under the Magnuson-Moss Warranty Act have been anticipated for some time. Even before Chair Khan was sworn in, the agency announced in March 2021 that it was assembling a new rulemaking group aimed at adopting new rules to deter novel harms impacting the digital economy.

Unless authorized specifically by statute, such as, for example, under the Children’s Online Privacy Protection Act, the FTC does not have general notice and comment rulemaking authority. Instead, under Section 18 of the FTC Act the agency has limited authority to promulgate specific rules defining “acts or practices which are unfair or deceptive acts or practices in or affecting commerce.” The FTC’s rulemaking procedures include a number of specific requirements, including publication of an advanced notice of proposed rulemaking, notice of proposed rulemaking, informal hearings, and a judicial review period that, collectively, have caused most Magnuson-Moss rulemakings to take years to complete. Indeed, the average Magnuson-Moss rulemaking lasts almost six years. The International Association of Privacy Professionals recently produced a helpful flow chart on the Magnuson-Moss rulemaking process which can be found on their website.

As soon as Chair Khan’s appointment was finalized last year, the FTC voted to “streamline” the agency’s internal procedural requirements for Magnuson-Moss rulemaking so that the agency could more expeditiously enact rules and enable itself to pursue “first-time violators of [newly-enacted] Trade Regulation Rules.” Days later, President Biden encouraged the FTC to promulgate new rules addressing “unfair data collection and surveillance practices.” In December 2021, Chair Khan announced in the FTC’s annual Statement of Regulatory Priorities for 2022 that the FTC would use rulemaking to tackle (among other things) “abuses stemming from surveillance-based business models.”