On March 26, 2012, the Federal Trade Commission (the “Commission” or “FTC”) released its much-anticipated final privacy report, Protecting Consumer Privacy in an Era of Rapid Change. The report builds upon the preliminary report released by the Commission in December 2010,2 and it provides recommendations for businesses and policymakers with respect to online and offline privacy practices. Specifically, the report:

•Presents a privacy framework that sets forth best practices – not legal requirements – for businesses. The Commission makes it clear that, to the extent that the best practices set forth in the report extend beyond existing legal requirements, they are not intended to serve as a template for law enforcement actions or regulation under laws currently enforced by the Commission. FTC Chairman Jon Leibowitz reiterated this point to a House Energy and Commerce subcommittee on March 29, 2012, telling legislators that, while companies that follow the report’s best practices would not be in violation of the FTC Act, those that do not follow them would not necessarily be in breach of the law. In his words, the report “is not a regulatory document or an enforcement document.” That said, those elements of the report that focus on transparency and consumer choice build on the Commission’s recent law enforcement experience. It is therefore reasonable to assume that the Commission will continue its pattern of focusing on data practices that are not obvious to consumers in context, that are not disclosed adequately, and, in some instances, where consumers do not have meaningful choice. Of course, the Commission will continue its aggressive enforcement of companies’ privacy and data security promises...