FTC weighs in on customer data privacy

The Federal Trade Commission has announced that it will consider rules to eliminate “harmful commercial surveillance and lax data security.” The Advanced Notice of Proposed Rulemaking comes even as Congress works on the American Data Protection and Privacy Act (ADDPA) which, if passed, would be enforced by the FTC.

Commercial surveillance is defined as the “business of collecting, analyzing, and profiting from information about people” — a definition as wide as anything contemplated by the ADPPA.

The FTC’s perspective. FTC Chair Linda M. Chan said in a statement: “Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts. The growing digitization of our economy — coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used — means that potentially unlawful practices may be prevalent.”

The FTC has authority to bring enforcement actions against unlawful data practices under the FTC Act, the agency said. However, this jurisdiction lacks teeth because of the limited authority to impose financial penalties. “By contrast,” the FTC said, “rules that establish clear privacy and data security requirements across the board and provide the Commission the authority to seek financial penalties for first-time violations could incentivize all companies to invest more consistently in compliant practices.”

Dig deeper: 3 things to know about the American Data Protection and Privacy Act

Adtech responds. “Unfettered collection and monetization of user data has allowed the big tech firms to grow unchecked, creating an oligopoly making it very hard for smaller players, many of whom stick to the moral and actual existing rules,” said Steve Dunlop, CEO of personalized ad agency A Million Ads. “We welcome any legislation that makes it a more level playing field for many firms to play, as well as a better and clearer deal for users.”

“At this point, behavioral targeting techniques are going to be made obsolete one way or another,” acknowledged Nadia Gonzalez, CMO of Scibids, a company that offers AI-powered digital marketing solutions. “It’s time for an enabling path in adtech,” she said — specifically the adoption of privacy-first advertising technologies, which she affirmed already exist.

Why we care. In jumps the agency and suddenly we have data protection running along two tracks, legislative and regulatory. The first thing to notice here is that the FTC, in its public statement, adopts the “surveillance” language common among activist groups that have been campaigning for stringent controls on data collection and use for years. That tells you where the FTC is coming from. Marketers do not, in our experience, think they are “surveilling” their customers.

The immediate reaction from the adtech industry is one of stoic acceptance. One way or another, data collection is going to be severely restricted. Get used to the idea and work on other ways to save addressability in advertising.

Dig deeper: 5 paths to post-cookie personalized advertising