FTC’s Effort to Strengthen Online Privacy Protections Faces Hurdles

The agency hasn’t announced the start of any broad rule-making process. But its new chairwoman, Lina Khan, a Democrat who has criticized big business, said in an October statement on the FTC’s data strategy that she intends to explore privacy standards as she probes emerging technologies, discriminatory data practices and companies’ amassing of consumer information to cement their market power.

Current and former FTC officials say budgetary wrangling in Congress will shape the agency’s ultimate impact on data privacy. Some observers also caution that writing broadly defined privacy rules under a rarely used authority known as Magnuson-Moss might lead the agency into legal gray areas that could result in successful industry lawsuits.

“For those who say that Congress hasn’t acted, so let’s have the FTC do it, it’s an uphill climb,” said Jessica Rich, who stepped down as director of the FTC’s Bureau of Consumer Protection in 2017 and now works for law firm Kelley Drye & Warren LLP.

The agency is reviewing piecemeal data regulations authorized in specific laws, issuing an update last week to a rule requiring financial institutions to secure customer data.

Some Democratic lawmakers have also urged the FTC to use its Magnuson-Moss authority, established in 1975, to write more general rules for data usage. Under that authority, the FTC could prohibit certain activity and potentially fine companies on the first offense.

To restrict a behavior under a rule created through Magnuson-Moss, the agency would have to argue it constitutes an unfair or deceptive practice that harms consumers, said Justin Brookman, a former FTC official who is now director of consumer privacy and technology policy for advocacy group Consumer Reports. There is little precedent for such arguments about privacy and they could be challenged in court, Mr. Brookman said: “We’re off the map here.”

Consumer advocates say the agency could use such power to restrict digital advertising, which relies on an opaque exchange of data among businesses to target users with content. Representatives for Facebook parent Meta Platforms Inc., Alphabet Inc.’s Google and Amazon.com Inc., which together control about 90% of the digital advertising market, didn’t respond to requests for comment.

Julie Brill, Microsoft Corp.’s chief privacy officer, said new privacy standards could improve trust in the technology sector by zeroing in on data brokers or “gatekeepers” that take potentially anticompetitive actions through measures aimed at security or privacy.

Ms. Brill, a former FTC commissioner, didn’t name particular companies. Google has drawn such criticism over its decision to end third-party cookies that rival companies use to target ads. Apple Inc.’s recent move to restrict how users are tracked on mobile devices has also come under fire from companies that say they have to spend a lot more money to find new customers. A representative for Apple didn’t respond to a request for comment.

While the Biden administration has promised to hold big tech companies accountable, broad rules could prevent businesses from making innovative use of consumer data in the future, said James Cooper, a former official in the FTC’s Bureau of Consumer Protection who is now an associate professor at the Antonin Scalia Law School at George Mason University. Such regulations could take several years to complete despite Democratic commissioners voting in July to streamline the Magnuson-Moss process, Mr. Cooper added.

Ms. Khan, who became FTC chairwoman in June, in her recent statement on the agency’s data strategy called for a shift away from the “notice-and-consent” framework for privacy, in which companies explain their data practices and ask for consumers’ permission to collect and use their information. Ms. Khan wrote that policing unfair or deceptive practices through that lens can sidestep “more fundamental questions about whether certain types of data collection and processing should be permitted in the first place.”

The agency told Congress that its inquiries into such behaviors would include more aggressive probes of digital platforms and enforcement of existing settlements with companies such as Facebook, now called Meta.

The FTC said the expansion would hinge on at least tripling the size of its Division of Privacy and Identity Protection, which has about 40 staffers.

Democratic lawmakers in September suggested creating a new FTC privacy bureau with $1 billion in funding from President Biden’s social-policy plan. But the administration last week pared down the sum to $500 million in its latest blueprint for the package.

Ms. Khan has introduced her approach amid a personnel shake-up that could influence potential rule-making, current and former officials said.

Two staffers who have overseen the FTC’s privacy work in recent years, the deputy director of the Consumer Protection Bureau and the associate director of the Division of Privacy and Identity Protection, left in October to join law firms. An agency spokeswoman didn’t respond to a request for comment on the departures.

Separately, President Biden nominated Alvaro Bedoya, a privacy scholar at Georgetown University, to an open seat on the commission. If approved by the Senate, Mr. Bedoya’s appointment would return Democrats to the majority of the five-member panel. The commission currently has two Democrats and two Republicans.

Noah Phillips, a GOP commissioner, said that differing views on FTC rules illustrate why Congress is best suited to define guardrails, rather than the panel on which he could soon be in the minority.

“The resolution of that question is much better had by elected officials than by, potentially, just three people,” he said.

Write to David Uberti at david.uberti@wsj.com