On August 11, 2022, the Federal Trade Commission (FTC) took the first step toward creating national privacy and security rules that, if finalized, would apply across most sectors of the U.S. economy. The agency unveiled an Advance Notice of Proposed Rulemaking (ANPRM), which asks for public comment on 95 questions, ranging from topics such as targeted advertising, security of personal information, algorithmic discrimination, and protection of children and teens. Comments are due within 60 days of publication of the ANPRM in the Federal Register. The ANPRM was issued with a 3-2 vote along party lines. This alert attempts to answer some key questions about the announcement.

What Is the FTC's Authority to Initiate This Rulemaking and Issue a Final Rule?

Section 18 of the FTC Act authorizes the FTC to issue trade regulation rules that define with specificity acts or practices that are unfair or deceptive (known as "Mag Moss Rulemaking"). Under Section 18, the agency must show that the unfair or deceptive acts or practices in question are prevalent, a determination that can only be made if the FTC has previously "issued cease and desist orders regarding such acts or practices," or if it has any other information that "indicates a widespread pattern of unfair or deceptive acts or practices."

What Areas Is the FTC Focused on?

In terms of subject areas that the questions touch on, there are few surprises. The FTC already announced in December 2021 that it would focus on issues like targeted advertising, data security, and algorithms. Given FTC Chair Lina Khan's prior public statements, it is not surprising that the ANPRM includes questions about employee privacy and workplace surveillance, competition, and the shortcomings of notice and consent. Commissioner Rebecca Kelly Slaughter and Commissioner Alvaro Bedoya have both spoken about civil rights and discrimination issues, as well as their concern about children and teens, both of which feature prominently in the ANPRM. A couple of points to note:

• Despite the fact that the FTC is currently undertaking a proceeding to review the Children's Online Privacy Protection Act (COPPA), the ANPRM includes a number of questions about protection of children's privacy. Although it is clear that the FTC is interested in extending privacy protections to teens, it is noteworthy that the ANPRM includes questions about children, despite the ongoing COPPA proceeding.
• In order to issue a rule designating a practice as unfair, the FTC must establish that likely harms of that practice are substantial, not outweighed by benefits to consumers or competition, and cannot be reasonably avoided. Despite the need to prove both harms and benefits, both the headline of the ANPRM and the narrative preamble to the 95 questions focus almost exclusively on the harm side of the equation. The only nod to benefits of targeted advertising, for example, is a statement that, "in theory, these personalization practices have the potential to benefit consumers."
• Along similar lines, the rhetoric in the ANPRM is more anti-business than we've seen from the FTC in the past. The entire proposal is directed to "commercial surveillance," with the term "surveillance" appearing 80 times.
• Perhaps reflecting Chair Khan's interest in intersections between competition and privacy, the ANPRM notably asks about the extent to which the FTC should limit companies in specific sectors from owning or operating businesses that engage in targeted advertising.
• Several questions mention the idea of third-party certifications for data security and privacy issues.
• In some areas, the rule goes beyond privacy, asking questions about content moderation and non-personalized content directed towards children and teens.

What Happens Next?

As noted above, the public has 60 days from the date the ANPRM is published in the Federal Register to comment. The FTC will host a virtual forum on September 8, where members of the public will be allowed to speak for two minutes. (See the process for applying to speak below.) After the 60-day comment period is over, the FTC will issue a Notice of Proposed Rulemaking, which will likely contain the rule text. After the comment period, a final Rule would still be some distance away. The average Mag Moss rule typically takes about five-to-six years; the Mag Moss rulemaking process allows any interested person to seek a hearing and present views. Indeed, the five-to-six-year timeline is likely to underestimate the time it would take to pass the type of broad-based Rule envisioned by the ANPRM; past Mag Moss Rules have primarily focused on narrower sectors of the economy (e.g., eyeglasses, funeral homes, home insulation).

Will the FTC Face Legal Challenges?

Even setting aside timing concerns, observers are discussing the implications of the U.S. Supreme Court's decision in West Virginia v. EPA on the FTC's rulemaking proceeding. In that case, the Supreme Court struck down an U.S. Environmental Protection Agency (EPA) rule, noting that the Rule went beyond the Congressional grant of authority. In a statement issued along with the ANPRM, Commissioner Slaughter attempts to distinguish the EPA case, noting that, with respect to the FTC's rulemaking proceeding, "Congress explicitly empowered the FTC to define with specificity acts or practices which are unfair or deceptive acts or practices in or affecting commerce." Unlike in West Virginia v. EPA, she notes that the FTC's delegated authority is not defined by "modest words," "vague terms," "subtle devices," or "oblique or elliptical language."

Why Should I Pay Attention?

The FTC appears to be considering approaches that could have a profound impact on the existing regulatory landscape and business models in place today. For example, the ANPRM asks about the extent to which new rules should "limit" targeted advertising. As another example, the current FTC approach to protecting children's privacy focuses on primarily regulating services directed to children under the age of 13. The ANPRM asks whether there should be enhanced protections for services that simply have large numbers of child users, potentially affecting social media, gaming, and sports and entertainment content that may be attractive to children. And the ANPRM asks whether techniques that "manipulate" consumers into prolonging online activity (e.g., video autoplay, infinite or endless scroll) may be unfair. A Rule provision on this issue could affect numerous consumer-facing companies.

As discussed above, while some might say that a final rule is a long way in the future and may in fact never happen, any proposed Rule issued by the FTC will be influential. As the ANPRM itself states, "[T]hese comments will help to sharpen the Commission's enforcement work and may inform reform by Congress or other policymakers, even if the Commission does not ultimately promulgate new trade regulation rules." Given the impact even a proposed rule is likely to have, companies should weigh in with comments. At the very least, they should pay attention to the process, which can provide clues about the FTC's enforcement priorities.

Why Did the Republicans Dissent?

In addition to noting concerns under West Virginia v. EPA, both Commissioner Christine Wilson and Commissioner Noah Phillips express concerns that by undertaking the Rulemaking process, Congress will be less incentivized to act on legislation. The Republican commissioners also express concern about the rhetoric of the ANPRM, with Commissioner Wilson noting that "[m]any practices discussed in this ANPRM are presented as clearly deceptive or unfair despite the fact that they stretch far beyond practices with which we are familiar, given our extensive law enforcement experience." Commissioner Phillips further takes issue with the fact that, in his view, the ANPRM is too broad to elicit meaningful feedback. And finally, Commissioner Phillips describes a number of substantive concerns. He takes issue with what he views as a step toward banning targeted ads, doing away with the concept of consumer consent, and regulating employee privacy, among other things.

In response, the Democratic commissioners dismiss concerns about disincentivizing Congressional action, with Commissioner Slaughter noting, "I am certain that action by the FTC will not clip the wings of Congressional ambition" and Commissioner Bedoya stating that he would not to vote for a final rule if Congress acts to cover the same practices in the interim. In response to concerns about the breadth of the proceeding, Commissioner Bedoya views such breadth as "a feature, not a bug," citing the need for a "diverse range of public comments to help us discern whether and how to proceed with Notices of Proposed Rulemaking."

What Should Companies Potentially Affected by the ANPRM Do?

• Read the ANPRM: Companies should read the ANPRM to get a sense of the FTC's interests and where the FTC is likely to go in terms of privacy and security enforcement actions.
• Engage: The FTC cannot issue a rule addressing unfair practices unless it has substantial evidence in the record that the likely consumer injuries are substantial, not outweighed by benefits to consumers or competition, and not reasonably avoidable by consumers. It is important to comment to build a record outlining the benefits of particular practices. Individuals or entities that would like to participate in the public forum by offering two-minute public remarks, should email Sept8testimony@ftc.gov. Because it appears panelists will be selected on a first come, first serve basis, it is important to submit requests early, and in any event before August 31, 2022. Companies should also consider filing public comments, particularly if they have evidence supporting the benefits of particular data practices.
• Shore up internal compliance: If your company is engaged in the activities mentioned in the ANPRM, their practices are likely on the FTC's radar screen. It will be important to have robust, appropriately resourced compliance programs in place if you receive a Civil Investigative Demand from the FTC.