FTC launches effort to review, update data privacy rules

The Federal Trade Commission (FTC) will launch an effort to review and update rules on how companies collect and use data, the agency announced Thursday. 

The FTC said it will explore rules to “crack down on harmful commercial surveillance and lax data security,” expanding on Democratic Chair Lina Khan’s aggressive action targeting tech companies. 

“The growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent,” Khan said in a statement.

“Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like,” she added.

The FTC commissioners voted 3-2 to start the process, which will begin by collecting public comments, with the two Republicans opposing the Democratic majority. 

The agency is expected to share more information about the effort during a news conference at noon Thursday. 

The FTC’s decision to move forward with a process to review and update data privacy protections comes as Congress is weighing proposals aimed at creating a comprehensive federal data privacy law. 

The House Energy and Commerce Committee advanced the American Data Privacy Protection Act (ADPPA) last month with bipartisan support. A version of the bill has been introduced in the Senate, but it lacks support from Senate Commerce Committee Chair Maria Cantwell (D-Wash.), hindering its chances of moving forward. 

Despite the bipartisan support for updating data privacy laws, the FTC’s decision faced a mixed reaction from leading lawmakers in Congress pushing to revamp the protections. 

Rep. Cathy McMorris Rodgers (R-Wash.), the ranking member of the House Energy and Commerce Committee and sponsor of the ADPPA, said the process to create those new protections should be carried out through Congress and not the FTC.

“I strongly share the goal of enacting robust privacy protections for Americans. That should be achieved by the American people speaking through their elected representatives and not through executive action,” Rodgers said in a statement. 

“Unlike a FTC rule, it includes a national privacy standard. One standard — clearly directed by Congress — is paramount to minimizing the amount of peoples’ information companies are allowed to collect, process, and transfer,” she added. 

Sen. Richard Blumenthal (D-Conn.), a leading voice pushing for updates to data privacy, especially for kids and teens, cheered the FTC’s action. 

“This announced rulemaking is a tremendous win for consumers, promising strong protections for privacy rights and personal data, and accountability for violating them,” Blumenthal said in a statement. “Big Tech’s exploitation of Americans’ private information, anti-competitive behavior, and data breaches have created a crisis that demands action. I’ve long urged the FTC to use this essential tool to implement strong and enforceable consumer safeguards and rights. This rule is a major step forward in helping give power back to consumers.”