FTC Weighs New Online Privacy Rules

Congressional efforts to assist the FTC in tackling perceived online privacy problems was the focus of a Senate Commerce Committee hearing Wednesday. If the agency chooses to move forward with an initiative, any broad new rule would likely take years to implement.

In writing new privacy rules, the FTC could follow several paths, the people said: It could look to declare certain business practices unfair or deceptive, using its authority to police such conduct. It could also tap a less-used legal authority that empowers the agency to go after what it considers unfair methods of competition, perhaps by viewing certain businesses’ data-collection practices as exclusionary.

The agency could also address privacy protections for children by updating its rules under the 1998 Children’s Online Privacy Protection Act. And it could use its enforcement powers to target individual companies, as some privacy advocates urge.

The FTC might choose not to move forward with any major privacy initiative. And action could be delayed as agency Democrats wait for confirmation of President Biden’s newest nominee to the commission, privacy advocate Alvaro Bedoya.

But since taking office June 15, Ms. Khan has made a number of moves to lay the groundwork for potential rule making, including by voting with the FTC’s two other Democrats to change internal procedures to expand her control over the rule-writing process. Mr. Biden has ordered the FTC to look at writing competition rules in a number of areas, including “unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy.”

This week, the progressive-leaning advocacy group Accountable Tech petitioned the agency to ban “surveillance advertising” as an unfair method of competition, defining the practice as targeted advertising based on consumers’ personal data. As an example of the harms that an alleged lack of competition among online platforms can cause, the group cited a recent Wall Street Journal article about the impact of Facebook Inc.’s Instagram app on teens’ mental health.

“The ability and incentive to extract more user data to unfairly monetize, even at the expense of children’s wellbeing, has proven too great a competitive advantage for dominant surveillance advertising firms to pass up,” the group’s petition said.

Facebook has said it faces stiff competition and that the Journal mischaracterized internal research on Instagram’s impact. It said this week that it was pausing work on a version of the photo-sharing platform designed for children under 13.

If the FTC decides to write a privacy rule, it would first have to publish a draft and seek public comment. In some circumstances, the law requires the agency to take additional, time-consuming steps such as asking for public input before even publishing a draft of a proposed rule.

Such efforts could get a boost from congressional Democrats seeking more funding for the agency.

Sen. Maria Cantwell (D., Wash.), who chairs the Commerce Committee, argued Wednesday for augmenting the FTC’s resources to better address problems of the online economy.

“The truth is that our economy has changed significantly, and the Federal Trade Commission has neither the adequate resources nor the technological expertise at the FTC to adequately protect consumers from harm,” she said in her opening statement.

Some Republicans said it wouldn’t make sense to add significant new funding to the FTC without passing new laws.

Earlier this month, House Democrats proposed giving the FTC a $1 billion budget to fund a new bureau dedicated to overseeing “unfair or deceptive acts or practices relating to privacy, data security, identity theft, data abuses, and related matters.” That proposal will be subject to negotiations as the narrowly Democratic-led Congress looks to pass a broad new spending plan this fall. Meanwhile, several Senate Democrats wrote to Ms. Khan on Sept. 20 asking her to write rules protecting consumers’ privacy.

The lack of a broad federal law protecting consumers’ privacy has become a bigger concern for advocates as online platforms and others have amassed vast troves of consumers’ search data and other information. Many privacy advocates are particularly worried about children, who can be more vulnerable to targeted online advertising and attention-grabbing algorithms.

Legislation to establish broad-based federal privacy protections has stalled again in Congress this year over a range of concerns. Efforts to update an existing 23-year-old federal privacy law covering younger children haven’t gained significant traction among lawmakers.

Critics say the Children’s Online Privacy Protection Act and the FTC-written rules that enforce it are ineffective and out-of-date, concerns that have helped lead the agency’s newly empowered Democrats to focus more on taking further action on privacy.

“I think it’s a really, really important area for attention,” Democratic FTC Commissioner Rebecca Slaughter has said of adopting broad-based privacy rules. She said at a July congressional hearing that a potential rule could target suspected online harms to children, adding, “That is an issue that’s near and dear to my heart.”

Ms. Khan and fellow Democratic commissioners indicated at that hearing that the agency would be giving more attention to how platforms might be abusing children’s privacy, as many kids have spent more time online during the Covid-19 pandemic. Democratic Commissioner Rohit Chopra added that the FTC should examine the underlying business models that can lead to privacy abuses.

Republican Commissioner Christine Wilson has become an advocate for federal privacy legislation, saying that consumers don’t understand how their data is collected and monetized, creating what she terms a “market failure.”

“Without this information, they cannot analyze the costs and benefits of using different products and services,” she said last week at Duke University. “And the risks to consumers from the unchecked collection of their data have intensified in recent years.”

Write to John D. McKinnon at john.mckinnon@wsj.com and Ryan Tracy at ryan.tracy@wsj.com