The ANPR comes at a contentious time for the FTC. The agency has suffered stinging defeats in court recently, including the Supreme Court decision in AMG Capital Management, LLC v. FTC, in which the Supreme Court unanimously held that the Commission has been unconstitutionally violating its statutory authority by seeking monetary relief under Section 13(b) of the FTC Act. Two commissioners dissented from the ANPR, which was issued at a time when FTC Chair Lina Khan (“Khan”) has been taking aim at what the agency refers to as “surveillance-based business models.” In recent months, leading tech brands and the Chamber of Commerce have resorted to the courts to contest new and aggressive agency investigative and enforcement practices. If rulemaking on the ANPR goes forward, it appears that the FTC will continue its pursuit of the technology industry by looking to aggressively limit—and in some instances foreclose altogether—data collection and usage practices that Congress has thus far declined to regulate. The FTC will also likely use any new, industry-wide rules as a novel hook for seeking monetary relief from companies.
Magnuson-Moss Rulemaking in the Khan Era: A Hammer Looking for a Nail?
The FTC’s present efforts to utilize its limited rulemaking authority under the Magnuson-Moss Warranty Act have been anticipated for some time. Even before Chair Khan was sworn in, the agency announced in March 2021 that it was assembling a new rulemaking group aimed at adopting new rules to deter novel harms impacting the digital economy.
Unless authorized specifically by statute, such as, for example, under the Children’s Online Privacy Protection Act, the FTC does not have general notice and comment rulemaking authority. Instead, under Section 18 of the FTC Act the agency has limited authority to promulgate specific rules defining “acts or practices which are unfair or deceptive acts or practices in or affecting commerce.” The FTC’s rulemaking procedures include a number of specific requirements, including publication of an advanced notice of proposed rulemaking, notice of proposed rulemaking, informal hearings, and a judicial review period that, collectively, have caused most Magnuson-Moss rulemakings to take years to complete. Indeed, the average Magnuson-Moss rulemaking lasts almost six years. The International Association of Privacy Professionals recently produced a helpful flow chart on the Magnuson-Moss rulemaking process which can be found on their website.
As soon as Chair Khan’s appointment was finalized last year, the FTC voted to “streamline” the agency’s internal procedural requirements for Magnuson-Moss rulemaking so that the agency could more expeditiously enact rules and enable itself to pursue “first-time violators of [newly-enacted] Trade Regulation Rules.” Days later, President Biden encouraged the FTC to promulgate new rules addressing “unfair data collection and surveillance practices.” In December 2021, Chair Khan announced in the FTC’s annual Statement of Regulatory Priorities for 2022 that the FTC would use rulemaking to tackle (among other things) “abuses stemming from surveillance-based business models.”
A Broad ANPR That May or May Not Result in Successful Rulemaking
On its face, the ANPR primarily seeks input regarding the nature and prevalence of harmful commercial surveillance practices (as defined above), lax data security practices, as well as proposals for protecting consumers from related harms. As briefly explained below, establishing the “prevalence” of the harmful practices to be regulated is an important statutory requirement for the FTC to issue rules under its Magnuson-Moss rulemaking authority.
Related to these goals, the ANPR also poses close to 100 discrete questions for public comment. Among other topics, the FTC solicits input on “algorithmic disgorgement”—the FTC’s recent practice of seeking to compel the deletion of work product derived from improperly collected consumer data—and questions whether consumer consent is a valid measure of fairness in light of “existing commercial surveillance today.”
It remains to be seen where the proceeding will go. First of all, although reining in “commercial surveillance” has been on the agency’s rulemaking agenda since before the start of the Khan era, issuance of the ANPR is not a firm commitment to moving forward with rulemaking. According to the ANPR, the FTC is seeking comments in order to “sharpen the Commission’s enforcement work and inform reform by Congress or other policymakers, even if the Commission does not ultimately promulgate new trade regulation rules.” The agency’s wait-and-see approach could stem from a desire not to interfere with ongoing, bipartisan Congressional efforts to pass comprehensive federal privacy legislation. It could also signal the FTC’s recognition of the challenges of the rulemaking procedure itself.
Second, the sheer breadth of the agency’s ambitions—when compared to its limited Magnuson-Moss rulemaking authority—may make it difficult to produce a final rule. Section 18 of the FTC Act authorizes the FTC to prescribe rules defining “with specificity acts or practices which are unfair or deceptive acts or practices in or affecting commerce” and related “requirements prescribed for the purpose of preventing such acts or practices.” The FTC must predicate Rulemaking on a finding that the targeted unfair or deceptive acts or practices are “prevalent,” either because the FTC has issued relevant cease and desist orders or because it has otherwise determined the existence of a “widespread pattern of unfair or deceptive acts or practices.” Defining industry-wide practices with sufficient specificity and making the case for their prevalence may be difficult. It seems quite possible given the breadth of the ANPR that very broad rules could easily trigger significant legal challenges to the agency’s authority and its interpretations of that authority. The business community, various trade groups, and other interested parties will doubtless be paying close attention during the public comment and judicial review phases of the rulemaking.
A Divided Commission Issues Comments Reflecting Competing Visions of the FTC’s Role and Constitutional Authority
In announcing the ANPR, Chair Khan issued a statement lamenting that “[t]he growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent.” Khan’s statement, coupled with her previous commentary on the tech and data industries, makes clear that the Chair and her Democratic colleagues on the Commission seek to usher in a wholesale shift in the way the FTC regulates, investigates, and adjudicates businesses’ offers of data-enabled goods and services.
The Commission’s Republican Commissioners, Christine Wilson and soon-to-depart Noah Phillips, both dissented from the ANPR, citing Commission overreach and momentum around a federal privacy law as key factors in their decisions. In particular, both highlighted the potential for the ANPR, based on its subject matter and timing, to sap support for legislative activity around the bipartisan American Data Privacy and Protection Act (“ADPPA”), with Wilson noting that she is “gravely concerned that opponents of the bill will use the ANPR as an excuse to derail the ADPPA.” As to overreach, Phillips noted that the ANPR “recasts the Commission as a legislature, with virtually limitless rulemaking authority where personal data are concerned,” while Wilson cautioned that the ANPR “wanders far afield of areas for which we have clear evidence of a widespread pattern of unfair or deceptive practices.”
Multiple other issues are likely to complicate any proceeding including: First Amendment concerns, interference with existing federal regulatory schemes and the attendant burdens of reconciling them, challenges to the legal sufficiency of the agency’s recordmaking, including whether and to what extent it may be entitled to judicial deference, and more.
Many of these specific legal issues will be beyond the understanding and immediate business interests of privacy and security professionals and their organizations. For these reasons any business that relies on data it receives or that relates to consumers—in other words, all modern businesses—should pay careful attention to the rulemaking process and consider weighing in on issues of concern.
The Commission is hosting a virtual public forum regarding the ANPR on September 8, 2022, while members of the public have until October 21, 2022 to issue comments on the ANPR generally. Businesses interested in participating in the rulemaking or its implications for their business should contact one of the authors in our Washington, D.C. office, listed below, or their usual Reed Smith relationship attorney.
Client Alert 2022-218
